Your git habits, prosecuted.
Paste any GitHub handle. We pull the public record, book them for crimes against version control, and hand down a sentence.
My crimes:
Force-pushed to main. Forty commits that just say fix. A repo last touched in
2019. A commit at 3:47 AM that says asdf. CommitCrimes reads your public GitHub
activity and charges you for all of it, with a statute number and a sentence.
A sample of the docket:
| Charge | Statute | What it means |
|---|---|---|
| Reckless Endangerment | § 401.A | Unprotected pushes straight to main |
| Obstruction of Clarity | § 118.2 | Commits that say nothing: "fix", "wip", "." |
| Disturbing the Peace | § 290.1 | Commits logged between 1 and 4 AM |
| Sabbath Breaking | § 311.2 | Weekend commits. Touch grass. |
| Abandonment of Property | § 510.7 | Repos left for dead, 1yr+ untouched |
| Verbal Assault | § 240.6 | Profanity in commit messages |
…and a dozen more in lib/charges.ts.
- Book anyone. Type a GitHub handle and get an instant rap sheet, a shareable mugshot card, and a README badge.
- Claim yours. Sign in with GitHub to claim your record and land on the public Most Wanted board.
- Go deep. Opt in to a Deep Record that also counts your private repos for the full sentence.
It's parody, built entirely on already-public data (unless you sign in for the deep version). The charges aren't real.
The whole project rests on one rule:
- We read commit metadata only (messages, timestamps, counts). We never read your source code — there is no code path that fetches file contents.
- Public lookups cache only the computed record (handle, sentence, charge titles + counts).
- A Deep Record uses your GitHub token in the moment and discards it. Private data is never stored unless you explicitly publish, and even then only counts + public-derived stats ship. Never repo names, never commit text.
- Remove yourself anytime at commitcrimes.dev/remove.
Full details: /privacy · SECURITY.md
Claim your record, then drop the badge in your profile README. Here's the maintainer's, live:
[](https://commitcrimes.dev/u/YOUR_HANDLE)- Next.js (App Router) + React + Tailwind
- Cloudflare Workers via OpenNext
- Cloudflare D1 (SQLite) + Drizzle ORM for the read-through record cache
- Clerk for GitHub auth (base
read:user, runtimerepostep-up for Deep) - PostHog for cookieless analytics + error tracking
- Share cards, OG images, and badges rendered server-side with
next/og
pnpm install
pnpm devCopy .env.example to .env.local and fill what you need.
Everything is optional locally: with no GitHub token you just get lower rate
limits, and Clerk (sign-in / Deep Record) and the database (cache / Most Wanted)
are no-ops when unset, so the public booking flow still works.
pnpm test # charge-engine tests
pnpm exec tsc --noEmit # types
pnpm run deploy # build with OpenNext + ship to CloudflareProduction secrets live in Cloudflare (wrangler secret put …); only publishable
keys sit in wrangler.toml.
app/ routes, metadata files, OG + sheet + badge image endpoints
components/ RapSheet, ResultView, search, share, footer
lib/ charges.ts (the engine), github.ts, deep.ts, store.ts, db/
drizzle/ SQL migrations
The best PR is a new charge. See CONTRIBUTING.md for the charge guide and the privacy invariant every change must keep.
MIT. The CommitCrimes name, logo, and the commitcrimes.dev domain are not covered by the license. Fork the code freely; please run it under your own name.
Parody. Not real charges or convictions. Not affiliated with GitHub, Inc.