security-ownership-map

Run the build script against your repository, then query summary.json for the bus_factor_hotspots and orphaned_sensitive_code sections. You can also filter files by tag, such as auth or crypto, with a maximum bus factor threshold using the query script.

The tool parses git log to count touches per person per file and applies sensitivity rules matching paths like auth, crypto, and secrets. The hidden_owners summary section reports anyone controlling more than a configurable share of a sensitive category.

You need Python 3 and the networkx package, which is required for community detection and GraphML export. Install it with pip install networkx before running the build script.

Yes, the build outputs people.csv, files.csv, edges.csv, and cochange_edges.csv formatted for Neo4j LOAD CSV import, with Cypher statements provided in the references. For Gephi, import the edge and node CSVs directly or use the optional GraphML output.

Lockfiles, .github config, and Dependabot commits create noisy supernode edges that distort file clusters. The script excludes them by default so communities reflect real code movement, and you can override the exclusions with command-line flags.

Analysis only reflects committed history, so it misses code review participation and uncommitted work. Very large repositories may need time-window filters like --since to keep git log processing manageable, and squash-merged history can obscure original authorship.