🌙🦊 Dalfox is a powerful open-source XSS scanner and utility focused on automation.
active 2025-03-23 → 2026-08-09 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 505 days from 2025-03-23 to 2026-08-09. Pushes: 548 total, peak 25 in a day. Pull requests: 216 total, peak 9 in a day. Issues: 83 total, peak 11 in a day. Comments: 173 total, peak 16 in a day. Stars: 417 total, peak 11 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| hahwul | 646 | 418 | 77 | 41 |
| dependabot[bot] | 120 | 7 | 102 | 11 |
| gemini-code-assist[bot] | 110 | 0 | 0 | 64 |
| github-actions[bot] | 85 | 84 | 1 | 0 |
| Copilot | 81 | 36 | 26 | 9 |
| codecov[bot] | 27 | 0 | 0 | 27 |
| ocervell | 10 | 0 | 0 | 4 |
| github-advanced-security[bot] | 8 | 0 | 0 | 7 |
| rudSarkar | 4 | 0 | 0 | 2 |
| sheikhshaheerimran | 4 | 0 | 2 | 2 |
| imgbot[bot] | 3 | 0 | 3 | 0 |
| ibrahmsql | 3 | 0 | 1 | 2 |
| emadshanab | 2 | 0 | 0 | 1 |
| Cruzcat1975 | 2 | 0 | 0 | 1 |
| iambouali | 2 | 0 | 0 | 0 |
| SecHoussam | 2 | 0 | 2 | 0 |
| Ruslan-TannicArcher-Semchenko | 1 | 0 | 0 | 1 |
| realnits | 1 | 0 | 0 | 0 |
| Skalyani234 | 1 | 0 | 0 | 0 |
| rayamajhii | 1 | 0 | 0 | 1 |
Recent activity
Latest issues, pull requests and releases
- Issue#1305hahwul2026-08-07 16:04test(shimmer): cover the `smoothstep` easing function
- Issue#1305hahwul2026-08-07 16:04test(shimmer): cover the `smoothstep` easing function
- Issue#1305hahwul2026-08-07 16:04test(shimmer): cover the `smoothstep` easing function
- Issue#1303hahwul2026-08-07 16:04test(tech_detect): cover the `has_interpolation_brackets` template heuristic
- Pull request#1236dependabot[bot]2026-07-19 07:53
- Pull request#1207dependabot[bot]2026-06-28 07:53
- Pull request#1207dependabot[bot]2026-06-28 07:53
- Pull request#1186hahwul2026-06-26 13:14
- Pull request#1163hahwul2026-06-21 07:55
- Pull request#1160hahwul2026-06-21 06:05
- Pull request#1155hahwul2026-06-19 00:44
- Issue comment#1151codecov[bot]2026-06-15 07:19fix(cli): apply config, global flags & --include-all in url/file/pipe subcommands
- Issue comment#1139codecov[bot]2026-06-14 11:41feat(scanner): unify HTML entity decoder, extend JS_SINK_NAMES, expand DOM evidence fixtures for FP/FN reduction
- Issue comment#1127codecov[bot]2026-06-13 07:06feat(scanner): model Document.parseHTMLUnsafe() + window.open() as DOM-XSS sinks
- Issue#1125hahwul2026-06-13 06:25AST DOM-XSS: Document.parseHTMLUnsafe() not modeled as a sink (setHTMLUnsafe is)
- Issue comment#1120hahwul2026-06-12 00:21feat(scanner): OOB/OAST (interactsh) blind XSS via --blind-oob
- Issue comment#1116codecov[bot]2026-06-11 08:47fix(scanner): remaining low-severity correctness, reporting & perf fixes
- Pull request#1110dependabot[bot]2026-06-07 07:52
- Pull request#1110dependabot[bot]2026-06-07 07:52
- Issue comment#1106codecov[bot]2026-06-05 23:50feat(scanning): detect & bypass size-limited WAF inspection windows (xssmaze waf-facade L2)
- Issue#1096hahwul2026-06-05 05:16Add a true --rate-limit (RPS) token-bucket limiter and adaptive WAF-evasion timing
- Issue comment#1101codecov[bot]2026-06-05 03:06feat(scan): accept HAR exports as a scan input type (#1095)
- Pull request#1081github-actions[bot]2026-06-02 15:38
- Pull request#1066hahwul2026-06-02 08:52
- Pull request#1062hahwul2026-06-02 04:29
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 417 stars here means stars gained during the window, not the repo's star count.