Only 2 of 128 YC-backed dev tools companies block unchecked merges

We scored 6,195 public GitHub repos at 128 YC-backed dev tools companies on four rules. The median scored 21 out of 100; no company cleared 80. Apollo took the top spot at 71.

But the most interesting thing isn't the scores. It's the pattern in the data: of the 44 companies that enable branch protection on most of their repos, only 2 block unchecked merges.

Scores

The rules

Each rule is summarized below; full definitions and the limits of public-scan mode live in .

• 
  Has branch protection. The default branch requires a pull request before changes can land. Median pass rate across the 128: 33%.


• 
  Has required checks. At least one check (status check, workflow, code scan, or deployment) must succeed before a merge. Median: 2%.


• 
  Has CODEOWNERS. A CODEOWNERS file exists at .github/, the repo root, or docs/. Median: 2%.


• 
  Has CI workflow. A recognized CI configuration is committed to source. Median: 45%.

Summer 2011
71
74%
58%
67%
86%


2

Summer 2020
61
100%
22%
38%
85%


4

Summer 2023
58
100%
0%
64%
71%


6

Winter 2019
55
100%
22%
16%
83%


8

Summer 2022
54
73%
6%
60%
80%


10

Winter 2021
51
91%
33%
0%
83%


12

Winter 2021
49
81%
23%
23%
72%


14

Winter 2018
44
78%
29%
24%
48%


16

Summer 2010
43
78%
15%
21%
60%


18

Winter 2022
42
75%
0%
23%
72%


20

Winter 2021
42
97%
2%
8%
62%


22

Summer 2021
42
76%
29%
17%
47%


24

Winter 2021
41
40%
20%
46%
60%


26

Summer 2019
38
37%
8%
41%
66%


28

Winter 2016
36
90%
3%
0%
53%


30

Summer 2020
35
58%
22%
4%
58%


32

Winter 2015
34
48%
6%
25%
60%


34

Winter 2021
34
76%
7%
0%
53%


36

Winter 2022
32
76%
0%
2%
52%


38

Winter 2020
32
48%
18%
14%
48%


40

Winter 2012
31
50%
3%
7%
65%


42

Winter 2023
31
28%
4%
40%
52%


44

Winter 2019
30
84%
3%
0%
34%


46

Winter 2020
29
33%
26%
12%
46%


48

Summer 2010
29
83%
3%
3%
27%


50

Winter 2020
29
66%
0%
6%
46%


52

Summer 2021
28
100%
0%
0%
14%


54

Summer 2020
26
54%
2%
0%
50%


56

Winter 2019
24
45%
2%
10%
40%


58

Summer 2021
24
33%
25%
0%
41%


60

Winter 2020
23
40%
0%
0%
53%


62

Winter 2023
22
2%
0%
2%
86%


64

Winter 2019
21
82%
0%
0%
2%


66

Winter 2021
21
37%
0%
18%
31%


68

Winter 2019
20
62%
0%
3%
15%


70

Summer 2019
19
17%
12%
3%
47%


72

Winter 2021
18
14%
0%
4%
57%


74

Summer 2023
17
7%
4%
1%
59%


76

Summer 2021
17
12%
4%
8%
44%


78

Winter 2019
16
16%
6%
6%
39%


80

Winter 2020
16
16%
8%
0%
41%


82

Summer 2015
15
12%
0%
0%
48%


84

Summer 2020
15
12%
6%
0%
43%


86

Summer 2023
14
25%
0%
0%
33%


88

Summer 2020
13
14%
2%
4%
34%


90

Summer 2022
13
8%
0%
4%
43%


92

Winter 2022
13
54%
0%
0%
0%


94

Winter 2020
12
30%
10%
0%
10%


96

Summer 2021
12
30%
0%
0%
20%


98

Winter 2023
11
30%
0%
0%
16%


100

Summer 2021
11
10%
0%
5%
31%


102

Winter 2019
9
14%
0%
5%
19%


104

Summer 2011
9
15%
5%
1%
15%


106

Summer 2020
8
3%
0%
3%
29%


108

Winter 2020
8
25%
0%
0%
8%


110

Winter 2022
7
7%
0%
0%
23%


112

Winter 2022
6
4%
0%
0%
22%


114

Winter 2023
5
2%
2%
0%
17%


116

Summer 2022
4
4%
0%
1%
12%


118

Winter 2023
4
4%
4%
0%
11%


120

Winter 2019
3
8%
0%
0%
4%


122

Winter 2022
2
0%
0%
2%
6%


124

Winter 2023
1
1%
0%
0%
6%


126

Winter 2020
0
0%
0%
0%
0%


128
.

How the 128 were chosen

The starting universe of 549 companies is the union of YC's developer-tools (532) and devops (50) tags, pulled from

Three of the four quadrants have companies in them. The top-left is empty: required checks attach to a protected branch, so the configuration can't exist.

The top-right is the rare exception. Of the 44 companies with branch protection on most of their repos, only 2 also require a check: (BP 96%, Chk 61%).

That leaves 42 in the bottom-right. They enable branch protection on most of their repos without requiring any check. Every change opens a PR; nothing has to pass for the PR to merge. for a full scan, private repos included.