Bus factor, now often called contributor absence factor, is the smallest number of contributors responsible for 50% of a project's contributions. To calculate it, count contributions per person, sort from highest, and add them up until you pass half the total. The number of people you needed is the factor.
What the number means
CHAOSS, the community that defines open source health metrics, describes the metric this way: a lower value means the project depends on fewer people, which is a continuity risk if they leave. A factor of 1 means one person did half or more of the work.
It does not say the project is unsafe today. A factor of 1 with a careful, long-serving maintainer can be fine. What it tells you is how much a single change in someone's life can affect your supply chain.
Steps to compute it
- Pick the contribution type. Commits are the easy default. Issues, reviews and documentation are alternatives.
- Pick a time window. The last 12 months is more useful than all time, because early authors may have left.
- Count per author. From a local clone:
git shortlog -sn --no-merges --since="12 months ago" HEAD
- Add the totals and take half.
- Walk down the sorted list, adding counts until you pass half. The number of names is your factor.
CHAOSS gives a worked example: eight contributors with 2,475 contributions in total. Half is 1,237.5. The top two contributors together made 1,433, so the factor is 2.
Caveats that change the answer
| Choice | Effect |
|---|---|
| Commits versus reviews | Reviews often spread across more people |
| Window length | A short window can hide long-term owners |
| Squash merges | One author name may hide co-authors |
| Bot commits | Dependency bots can inflate counts, so exclude them |
| Several repositories | A project may span repos, so count across them |
CHAOSS also notes that collecting contributor data can raise privacy and terms of service concerns, including GDPR and US state law questions. Use aggregate counts and do not publish a person-level analysis. This is not legal advice, so check with counsel if you build a program around it.
What else counts
Bus factor measures who writes code. Release access is a separate question. Who can publish to the registry? On npm and similar registries the owners list is public on the package page. A project with five committers but one publisher still has a factor of 1 where it matters most.
Pair the number with whether the project sits inside an organization, which usually means someone else can grant access to a successor. See single maintainer or foundation backed.
What to do with a low factor
- Pin exact versions so a rushed release does not reach you automatically.
- Add the package to monitoring for new advisories.
- Write an exit plan: who in your team could fork or replace it.
- Re-check every quarter. Factors drift.
Safeguard can help here. Its SBOM and dependency scanning, reachability analysis and policy gates cover the checks that should repeat after adoption, and the free scan at gold.safeguard.sh/scan shows what a project already depends on.
Quick check
Is a bus factor of 1 an automatic reject?
No. It is a risk to manage with pinning, monitoring and an exit plan, especially for small, focused libraries.
Should I exclude bots from the count?
Yes. Automated commits can make a project look more active and more shared than it is.
Sources
Last reviewed: 19 October 2026.
