GitHygiene is a dependency health and vulnerability intelligence platform, built for Hacktoberfest Hack Day — Coimbatore 2026 (INIT CLUB × iDEA CLUB × MLH).

What it does: It gives developers a single dashboard showing the security and health of every GitHub repository they own.

Core workflow:

1. Sign in with GitHub (via Supabase Auth, GitHub OAuth only)
2. Import repositories from the user’s GitHub account
3. Scan — reads dependency manifests, checks every package against the OSV.dev vulnerability database and public package registries (npm, PyPI), and computes a health score for each repo
4. Explore — surfaces vulnerable packages, outdated/deprecated dependencies, a cross-repo dependency graph, and AI-generated explanations and upgrade plans

What makes it different:

• Cross-repository blast radius — answers “which of my repos does this vulnerability reach, and through what chain of packages?” (most scanners can’t do this)
• Plain-language explanations — an LLM explains findings and generates ordered upgrade plans, grounded in actual scan data
• Built entirely on open data — OSV.dev, the GitHub API, and public registries, no paid feeds
• Multi-ecosystem — npm and PyPI at launch, designed to extend to more

Tech stack:

• Frontend: React (Vite), Tailwind CSS, Recharts, React Router
• Backend: Node.js/Express
• Auth & DB: Supabase (Postgres + GitHub OAuth)
• Graph DB: Neo4j Aura Free (for the dependency graph — optional at runtime, scans still work if it’s unreachable)
• AI: an LLM behind a dedicated service module for explanations/upgrade plans

Scoring: starts at 100, docked for critical/high/medium/low vulnerabilities, deprecated direct dependencies, and outdated major versions — mapped to low/medium/high/critical risk tiers.

Key design principles: read-only against GitHub (never writes to a user’s repo), strict user data isolation, graceful degradation when optional services (Neo4j, LLM) are unavailable, and no fabricated claims in documentation.