Trust Checks

Anyone can make a GitHub account in a minute, and so can a script. If brand-new accounts counted, one person with a few dozen of them could move the whole list. So before the bot takes a submission, counts a Like or acts on a report, it checks the account behind it.

Most real developers pass without noticing.

The trust rule

An account is trusted when all of these are true:

Check	Passes when
Not blocked	The account isn't blocked by the devstreamhq organization, and isn't on my private exclusion list for sock puppets
Not a bot	The account isn't a GitHub App or bot account
Old enough	The account was created 30 or more days ago
Some real activity	The account has at least 1 public repo, or at least 1 contribution in the last 365 days

Owners are held to the same rule, and so am I. Nobody gets a pass.

A contribution here is anything on your GitHub contribution graph: commits, issues, pull requests, reviews. Private contributions only count if your profile shows them. If you work mostly in private repos and have no public repos, turn on Include private contributions on my profile in your profile settings.

Who needs what

To...	You need	See
Submit a repo	The trust rule, plus no more than 3 submissions in 7 days	Submitting a Repo
Like an entry	The trust rule	Likes and Ranking
File a report	Nothing to get it filed. The bot closes incomplete forms, reports on repos that aren't listed, and a sixth report in 24 hours. Every other report gets needs-review for me to read.	Reporting an Entry
File a report the bot acts on	The trust rule, plus no more than 5 reports in 24 hours	Reporting an Entry
Count toward hiding an entry	The trust rule, plus an established account. Only spam reports count toward the 3; one malicious report hides the entry on its own.	Established accounts

Established accounts

Hiding an entry is a big step, so reports only hide one when they come from accounts with a longer history. An account is established when it's trusted and also:

• at least 1 year old, and
• has 50 or more contributions in the last 365 days, or owns 3 or more repos that aren't forks.

Forks don't count toward the 3, because a fork takes one click.

What the messages mean

The bot says	What to do
"Your account needs to be at least 30 days old."	Wait until it is, then try again.
"We couldn't find public activity on your account in the last year."	Make a public repo, contribute somewhere, or show private contributions on your profile.
"Bot accounts can't submit or Like."	Use your personal account.
"This account can't submit to DevStream."	The account is blocked. See below.
"We couldn't find that GitHub account."	Rare. It usually means the account was renamed or deleted mid-run.

How often the bot checks

For Likes, the bot remembers each account's result for up to 7 days, so it isn't looking up every account every hour. That means an account that has just turned 30 days old can take up to a week to start counting. Blocks are the exception: the bot checks them on every run, so a block takes effect within the hour.

Submissions and reports are checked fresh every time.

Blocks

Blocks are for spam, sock-puppet voting and abuse. A blocked account can't submit, its Likes don't count and its reports aren't acted on automatically. The exclusion list for spotted sock puppets is private, so there's no public list of names. See GOVERNANCE.md.

Think you've been blocked by mistake? Ask in Discussions Q&A, and I'll look.