Audit-Before-You-Deploy Health Score for Self-Hosted Apps After the BookLore-to-Grimmory Detonation
BookLore's solo maintainer ACX got caught merging 20,000-line AI-slop PRs, banned community members who flagged it, then nuked the GitHub, Discord, and website overnight in March-April 2026. The community refloated as Grimmory, but every self-hoster running selfh.st-popular apps now has the same nervous question: 'how do I tell, before I deploy this, whether it's a one-person time bomb?' Demand is for a continuously-updated health score per self-hosted project (bus factor, AI-PR ratio, license stability, fork-readiness, last-90-days incident log). Think Snyk for trust, not vulnerabilities.
The trap is trying to be a security scanner. The win is the soft signal... PR turn-around variance, contributor count trend, the ratio of AI-shaped PRs, plus a public 'maintainer-banned-a-contributor' incident log scraped from GitHub blocks/issue locks. Sell to the homelab+selfh.st audience, not enterprises (Snyk owns that).
landscape (3 existing solutions)
Existing tools score security and license, not governance and bus-factor. The actual question self-hosters ask before adoption ('is this a one-person project that's about to nuke itself?') has no public signal.