01 · Roasts
Public heatmap, private iceberg
Only 38 public commits this year leave the heatmap looking intermittent, even though private-work detection says the visible record is incomplete.
Documentation beats DevOps
TransitionPlayer and the blog explain Android internals in depth; neither brings tests, CI, or a license to the incident response.
CVE printer, build pipeline missing
CVE-2026-0091 earned TransitionPlayer 34 stars, but the PoC still ships without automated verification.
Audience acquired
2,356 followers and 4,469 total stars say people are listening; following only 3 accounts is an aggressively asymmetric RSS feed.
Built using
Zoral
Shadows one worker for a week, then takes over their job with zero extra setup. Behaves exactly like the original.
zoral.ai
02 · Category breakdown
- Impact25% weight53D
- Consistency20% weight55D
- Quality20% weight39F
- Depth15% weight65C
- Breadth10% weight40D
- Community10% weight65C
03 · Stats
365-day commit heatmap
55 active days
Language distribution
- C97%
- Assembly2%
- HTML0%
- Makefile0%
- Perl0%
- Java0%
- Other1%
04 · Numbers
Owned repos
non-fork
18
Commits
last 12 months
38
Followers
2,356
Joined GitHub
Aug 2017
05 · Top repos
canyie /
canyie.github.io
A long-running static Hexo blog documenting original Android internals research and CVE analyses, including CVE-2024-48336, CVE-2024-49721, and CVE-2026-0091, with substantial technical writeups but minimal project metadata.
canyie /
TransitionPlayer
A focused Android security PoC demonstrating CVE-2026-0091 by intercepting transitions, extracting IApplicationThread, and executing code in the Launcher process; documented with Android source links but lacking tests, CI, and a license.
canyie /
canyie
A personal profile repository with a substantial README documenting Android security research, conference outputs, and many CVE references, but only 15 stars and no sampled implementation files or engineering infrastructure.
canyie /
report-tracking
A small but useful Android security-issue mirror with clear disclosure guidance and a structured security-report template; its limited stars, single sampled template, and lack of engineering infrastructure constrain broader impact and depth.
06 · Timeline
- Aug 30, 2017Joined GitHub
- Jul 29, 2019Created canyie.github.io — 残页的小博客
- May 21, 2022Created canyie — It's me!! So cute!!!
- May 25, 2026Created TransitionPlayer — CVE-2026-0091, play with an issue in android window management to perform arbitrary code execution in Launcher process from adb
- Jul 17, 2026Created report-tracking — Mirror of reported security issues
- Aug 31, 2026Most recent push to TransitionPlayer
07 · Compare
08 · Rubric
How this score was produced
Overall = Σ (category × weight) + gentle top-end curve
Tier thresholds
▸ How the pipeline works
- 01Scrape.Pull every non-fork repo pushed in the last 90 days, plus your contribution calendar, followers, and language byte counts — straight from GitHub's REST & GraphQL APIs.
- 02Triage.A small model reads every repo's file tree + README and picks the 20 files per repo that actually reveal how you code.
- 03Grade each repo. All repos run in parallel through a fast scoring model that reads the picked files and rates each one independently on Impact, Quality, and Depth — with evidence citations.
- 04Aggregate. A larger reasoning model combines the per-repo scores with server-computed stats (heatmap, commit cadence, language entropy, follower count) to produce the 6-dimension profile score + roasts.
- 05Correct.Deterministic server-side checks enforce anchor-scale floors (e.g. a profile with 2,000+ public commits can't score 30 Consistency) and recompute the final verdict.
~90 seconds per profile, ~$0.25 in compute. Total of ~240 files read across your top-12 repos. One rating per GitHub account per day.
▸ Data sources & caveats
- Heatmap & commit totals: GitHub GraphQL
contributionsCollection— covers the last 365 days, includes private repos when the user has opted in (default). - Language %: byte totals across the top 30 owned non-fork repos.
- Curve: a small upward nudge centered on raw score ≈ 70, capping at 100. Prevents specialists from being unfairly penalised for narrow breadth.
- Anchor corrections: when server-measured signals (e.g. privateWorkLikely, multiRepoVolume, follower count) mandate a minimum category score, the aggregation step enforces it. These are signal-conditional, not identity-based floors.