HackerReposA FIELD GUIDE TO OPEN SOURCE
ProSponsor the shelf♧ 0
← Back to top all-time
mitchellh
vouch
Nushell2026–2026
mitchellh / vouch

vouch

A community trust management system based on explicit vouches to participate.

Explore on GitHubRead Hacker News discussions
23Distinct people
23Mentions
0Explicit recommenders
5.2KGitHub stars
REPOSITORY AT A GLANCE

What to know before exploring

What it is

A community trust management system based on explicit vouches to participate.

GitHub

Where it is used

No documented product use was verified in the last source check.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

Mentioned in the same Hacker News threads. That is not proof they are substitutes.

This week on Hacker News

Nov 8–Nov 15 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/15/2026, 9:01:12 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by month23 dated mentions

Observed mentions: 2026-02-07 21:48:15 UTC to 2026-10-12 15:38:13 UTC.

0369122026-02-01 00:00:00 UTC to 2026-03-01 00:00:00 UTC (exclusive): 11 mentions; 4 submissions, 7 commentsFeb 20262026-03-01 00:00:00 UTC to 2026-04-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-04-01 00:00:00 UTC to 2026-05-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-05-01 00:00:00 UTC to 2026-06-01 00:00:00 UTC (exclusive): 5 mentions; 0 submissions, 5 comments2026-06-01 00:00:00 UTC to 2026-07-01 00:00:00 UTC (exclusive): 3 mentions; 0 submissions, 3 commentsJun 20262026-07-01 00:00:00 UTC to 2026-08-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-08-01 00:00:00 UTC to 2026-09-01 00:00:00 UTC (exclusive): 0 mentions; 0 submissions, 0 comments2026-09-01 00:00:00 UTC to 2026-10-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 comments2026-10-01 00:00:00 UTC to 2026-11-01 00:00:00 UTC (exclusive): 1 mentions; 0 submissions, 1 commentsOct 2026

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges
UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
PeriodStart (UTC)End (exclusive, UTC)MentionsSubmissionsComments
Feb 20262026-02-01 00:00:00 UTC2026-03-01 00:00:00 UTC1147
Mar 20262026-03-01 00:00:00 UTC2026-04-01 00:00:00 UTC101
Apr 20262026-04-01 00:00:00 UTC2026-05-01 00:00:00 UTC101
May 20262026-05-01 00:00:00 UTC2026-06-01 00:00:00 UTC505
Jun 20262026-06-01 00:00:00 UTC2026-07-01 00:00:00 UTC303
Jul 20262026-07-01 00:00:00 UTC2026-08-01 00:00:00 UTC000
Aug 20262026-08-01 00:00:00 UTC2026-09-01 00:00:00 UTC000
Sep 20262026-09-01 00:00:00 UTC2026-10-01 00:00:00 UTC101
Oct 20262026-10-01 00:00:00 UTC2026-11-01 00:00:00 UTC101

What Hacker News says

11 sources
kvinogradov·Feb 26, 2026
The curl guy is one of OSE founding donors, together with the terraform guy who recently released an open source trust management system to help with AI-generated crap: https://github.com/mitchellh/vouch I think that AI eventually will solve technical maintenance problems, but not human-related ones: limited attention, trust, motivation issues. And we are going to support mostly "old" projects everybody relies on, not some new AI-gen stuff.
In Open Source Endowment – new funding source for open source maintainers
Aachen·Feb 9, 2026
I've thought about making such a system before, but never considered making it a single flat file¹. How are you going to identify who keeps inviting these bad actors? Assuming the list is under source control, the commit history can answer this question but it's manual work whereas a tree/graph system shows you directly who is making the bad judgement calls (may be intentional or not, so this person can keep contributing so long as those contribs are good, but not invite further people). I don't understand the added value of a bunch of software around what is essentially an allowlist where the commit history already shows why someone was added or removed ¹ https://github.com/mitchellh/vouch?tab=readme-ov-file#vouche...
In Vouch
btown·Feb 9, 2026
Per the readme: > Unfortunately, the landscape has changed particularly with the advent of AI tools that allow people to trivially create plausible-looking but extremely low-quality contributions with little to no true understanding. Contributors can no longer be trusted based on the minimal barrier to entry to simply submit a change... So, let's move to an explicit trust model where trusted individuals can vouch for others, and those vouched individuals can then contribute. And per https://github.com/mitchellh/vouch/blob/main/CONTRIBUTING.md : > If you aren't vouched, any pull requests you open will be automatically closed. This system exists because open source works on a system of trust, and AI has unfortunately made it so we can no longer trust-by-default because it makes it too trivial to generate plausible-looking but actually low-q
Read the rest
uality contributions. === Looking at the closed PRs of this very project immediately shows https://github.com/mitchellh/vouch/pull/28 - which, true to form, is an AI generated PR that might have been tested and thought through by the submitter, but might not have been! The type of thing that can frustrate maintainers, for sure. But how do you bootstrap a vouch-list without becoming hostile to new contributors? This seems like a quick way for a project to become insular/isolationist. The idea that projects could scrape/pull each others' vouch-lists just makes that a larger but equally insular community. I've seen well-intentioned prior art in other communities that's become downright toxic from this dynamic. So, if the goal of this project is to find creative solutions to that problem, shouldn't it avoid dogfooding its own most extreme policy of rejecting PRs out of hand, lest it miss a contribution that suggests a real innovation?
In Vouch

MAKE YOURSELF AT HOME

A few shortcuts

/
Search the collection
?
Open this guide
Esc
Close dialogs and navigation

Your saved repositories and interests stay in this browser.