Anonymous counts
fremforge publishes numbers about how its security features work in practice, such as how many open dependency findings have no call path to the vulnerable code, or how long fixes take. Organisations can choose to contribute anonymous counts to those numbers. The setting is off unless an org owner switches it on, and no organisation is ever named.
No numbers are published yet. A published number must rest on at least five contributing organisations (see When a number may be published), and there are not five yet. This page describes the method in advance so it can be checked before any number appears.
Switch it on or off
The setting is at Security › Reports › Remediation metrics (/<org>/_admin/security/reports/remediation), in the Contribute anonymous counts card, which shows whether it is on, since when and how many days are stored. Org owners can change it.
- On: from the next morning (UTC), one row of counts is stored for the organisation per day.
- Off: collection stops, and every day already stored for the organisation is deleted at once.
The same setting is available over the API and in Terraform:
GET /_app/api/v1/orgs/{org}/security/anonymous-counts policy:read
PUT /_app/api/v1/orgs/{org}/security/anonymous-counts policy:write {"enabled": true}GET returns enabled, enabled_at, stored_days and min_orgs_to_publish. PUT also returns previous, changed and deleted_rows, the days deleted when it is switched off. Every change is in the audit log as code-security.anonymous_counts.updated.
resource "fremforge_anonymous_counts" "this" {
org = "acme"
enabled = true
}Destroying the Terraform resource leaves the setting as it is. To stop contributing, set enabled = false.
What is shared
Once a day, for the previous complete UTC day:
| Count | What it is |
|---|---|
| Open findings | How many findings are open, by type (dependencies, images, SAST, secrets, licences and the rest) and severity, at the time of collection. |
| Reachability | How many open dependency findings on default branches are reachable, have no call path, or are unknown, as on the Remediation metrics page. |
| Security fix pull requests | How many security fix pull requests were opened and how many merged that day. |
| Time to fix | For findings fixed that day, per severity: how many, how long they were open, and a histogram of those times in fixed buckets (under 1 day, 1–2, 2–4, 4–7, 7–14, 14–30, 30–60, 60–90, 90–180 days, and longer). |
Never shared: names of repositories, packages, images, advisories or rules, code, file paths, and anything about people. The stored row holds the counts and your organisation’s internal ID. The ID is used only to delete your days when you switch this off or your organisation is deleted, and to replace a day rather than add a second one. Nothing published or shared carries it, and fremforge staff tools that read the counts see no organisation identity.
Time to fix excludes findings that were closed by auto-resolve, which closes a finding by policy rather than fixing it, and findings whose opening time is not known because they were recorded before finding history began.
When a number may be published
- Only from organisations that switched it on. fremforge also measures its own features across all organisations as counts, for operating the service. Those internal measurements are never published.
- At least five organisations behind every number. Each number is checked on its own: a figure about time to fix critical findings needs five organisations that fixed a critical finding in the period, not merely five organisations in total. A number from fewer is not published at all, rather than rounded or shown with a caveat.
- No organisation is named, and nothing is published that would let one be singled out.
- fremforge’s own organisations are kept apart. They are shown separately when we check the numbers and are never part of a published figure.
How the numbers are made
- Snapshots (open findings, reachability) use each contributing organisation’s latest day in the period, summed.
- Flows (pull requests, fixes) sum every day in the period, usually 30 or 90 days.
- Time to fix across organisations is reported as the histogram bucket the overall median falls in, for example “7–14 days”. A median of each organisation’s median would not be the median of all the fixes, so we do not compute one.
- Each published number carries its period, the number of contributing organisations and a link to this page.
Retention
A stored day is kept for 25 months, then deleted. Switching the setting off deletes the organisation’s days at once. Deleting the organisation deletes them too.