Radar check
What we found when we opened it. Every bar is one fact, with its date.
Last code pushed 20 Oct 2026, 5 days before this check.
Latest release v1.5.0 on 20 Oct 2026.
Public since August 2026, 2 months.
2 stars and 0 forks.
23 commits and 0 new issues in the last 90 days.
1 contributor. No pull requests merged in 90 days; changes go in directly. A small team carries it.
No security policy file says how to report a problem. No published security advisories.
How the bars are scored
- Alive. Days since the last code push: a week or less 100, a month 90, three months 70, six months 50, a year 30, eighteen months 15, older 0.
- Releases. Age of the latest GitHub release, on a similar scale; no bar when the project publishes no releases.
- Maturity. Age of the project: eight years 100, five 90, three 70, two 55, one 40, six months 25, younger 10.
- Adoption. Stars on a log scale: 100,000 stars is 100, 10,000 is 80, 1,000 is 60, 100 is 40.
- Activity. Commits in the last 90 days: 300 or more 100, 100 85, 30 65, 10 45, any 25.
- Community. People who have contributed: 100 or more 100, 30 80, 10 60, 5 40, 2 25, one 10.
- Security. A published security policy 80, none 40; published advisories are listed, not scored.
Checked by Repo Radar on 26 Oct 2026 from the repository on GitHub.
In simple English
This tool scans public records to find what online services a company uses. It looks at domain names, email settings, and security logs to spot hidden software subscriptions. You run it from a command line by giving it a website address. It saves time during security audits by discovering forgotten tools. The software is free and open source, but you need some technical skill to run it.
What it is
Yowie is a security reconnaissance tool written in Go that discovers an organisation's shadow IT footprint from public data. It evaluates domain records, certificate transparency logs, and vendor endpoints against an embedded database of signatures.
What it is good for
Security engineers and IT administrators who need to map out every software service a company or its subsidiaries rely on without needing internal network access.
- Requires no internal access or credentials to run its scans.
- Combines multiple detectors like DNS, SPF, and certificate logs into one report.
- Generates self-contained HTML reports that are easy to share with colleagues.
- Requires comfort with the command line and basic domain name concepts.
- Short brand names often trigger contested namespace warnings and false positives.
- Some detectors rely on slow certificate transparency aggregators.
Manual domain checks and incomplete asset spreadsheets
dig
- owasp-amass/amass15k stars
Maps attack surfaces and subdomains using open-source intelligence and active reconnaissance.
- projectdiscovery/subfinder15k stars
Fast passive subdomain enumeration tool for discovering valid web assets.
- goauthentik/authentik26k stars
One place for people to sign in, which every other tool can ask instead of keeping its own passwords.
- cossacklabs/themis2.0k stars
Four ready-made encryption jobs with the choices already made, in fifteen languages.
- smallstep/certificates9.0k stars
A certificate authority you run yourself, for machines the public internet cannot reach.
git clone https://github.com/joda32/yowie cd yowie go build -o yowie ./cmd/yowie ./yowie example.com