Skip to content

3.5 Years of Vulnerability-Lookup in Under 3 Minutes

I turned the Git history of Vulnerability-Lookup into a Gource visualization. Every dot is a file, every beam is a contributor at work, and the tree grows as the project evolves.

A few milestones you’ll spot in the video

  • 📅 10 April 2023: first commit, simply titled “initial repo”
  • 🚀 19 June 2024: v1.0.0
  • 🔁 18 October 2024: v2.0.0
  • 🤖 26 January 2026: first Claude-assisted commit, introducing a user-managed KEV catalogue compliant with GCVE BCP-07
  • 🏷️ 14 October 2026: v6.3.0, our 57th release

A few numbers: 3,435 commits, 32 contributors, and more than 90 vulnerability sources.

The last nine months

The most interesting part, for me, is the last nine months.

Since January, 658 commits include a Claude Co-authored-by trailer, representing around 45% of all commits during that period. In the video, each Claude model family (Opus, Sonnet and Fable) appears as a separate contributor, and files touched by AI-assisted commits light up in the corresponding model’s colour. You can literally watch that footprint spread across the codebase.

Of course, this is only what we can see in Git. The visualization detects AI assistance through the Co-authored-by trailer, and not everyone includes one. Many contributors use AI assistants without leaving any trace in their commits, so the actual share of AI-assisted work is likely higher. These numbers should be treated as a lower bound.

Personally, I think keeping a record of which model contributed to a commit is good practice. It’s simple and transparent, and much less intrusive than watermarking the source code itself. With AI-generated content becoming increasingly difficult to distinguish from human-created work, I believe provenance matters more than ever. I’m in favor of watermarking AI-generated content, as long as it is implemented in a transparent and responsible way.

The pace has changed, too

We had around 900 commits in all of 2024, compared with more than 1,400 already in 2026. And since June, the pace has been incredible!

We’ve had around 200 commits every month: 197 in June, 217 in July, 203 in August and 199 in September. That’s almost three times our 2025 monthly average of around 75 commits.

In those four months alone, we shipped 11 releases and added 53 vulnerability sources, including 43 CSAF vendor feeds on a single day. June was also the month when Claude-assisted commits peaked, accounting for roughly two-thirds of all commits.

Giving credit

But there’s another aspect worth acknowledging.

Git still lists a human as the author of every one of these commits, with the AI credited as a co-author. I think that label increasingly understates what’s happening.

In practice, AI is doing much of the work, and not just writing code. It proposes designs, suggests features and brings ideas we hadn’t thought of. A significant part of the design and creative process now comes from AI.

Our tools for giving credit haven’t caught up with this reality yet.

Thanks

Thanks to everyone who has contributed to Vulnerability-Lookup over the years (and to the AI agents 😉).

🎵 Music: Grieg – In the Hall of the Mountain King, Czech National Symphony Orchestra (Musopen, via classicals.de)