defirisk.co
rubric v1.7.0

GitHub force-push to sensitive branch

Jupiter's assessment for RD-F-108 — scored not_assessed on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.

Evidence summary #

v1-deferred per T-09 §3.3. Primary program source (aggregator v6) is closed-source — most critical code is not in a public GitHub branch. jupiter-cpi repo was archived Nov 2025. No force-push incidents on jup-ag public repos publicly reported. Signal has limited value for this protocol given closed-source primary.

Sources #

  • GitHub
    jup-ag GitHub Organizationgithub.com/jup-ag — primary org; jupiter-cpi archived Nov 2025; primary source closed-sourceretrieved 2026-04-29
  • Internal
    T-09 Real-Time Signals v1 Scope — v2/deferred tableT-09 §3.3 v2/deferred — F100 GitHub force-push: requires GitHub permissioned access per protocolretrieved 2026-04-29

Methodology #

Detect whether the repository shows a force-push or push to a sensitive branch (main, production tag) from a non-protocol account.

See the full factor methodology and distribution across all protocols →

rubric_version v1.7.0 protocol jupiter factor RD-F-108 score not_assessed collected_at 2026-04-29 11:51:25