Which has better activity and maintenance signals?

Based on the RepoPilot analysis provided:

cirruslabs/tart shows stronger maintenance signals:

• Dependency security: 0 critical, 0 high, 0 moderate CVEs across 6 direct dependencies (pypi) — a clean bill of health.
• Code scanning (SAST): 0 open alerts.
• Architecture grade: C (50/100) with 0 import cycles — no structural debt from circular dependencies.
• Community adoption: The README lists 10+ major companies actively using Tart (Atlassian, Figma, Mullvad, Krisp, TestingBot, Symflower, Transloadit, Cirrus CI, PITS Data Recovery, Expo).
• Stats: 6,673 stars, 356 forks — significant community engagement.

Weaknesses noted:

• OpenSSF Scorecard is only 5.6/10, with gaps in Dependency-Update-Tool (0/10), Security-Policy (0/10), and SAST tooling (0/10).

milanvarady/applite has no RepoPilot analysis in the provided data, so I cannot make a direct security or architectural comparison. The repository_data shows active code (shell environments, database operations, UI state management) but lacks the computed signals needed to assess maintenance velocity, dependency health, or structural quality.

In summary: cirruslabs/tart demonstrates better documented maintenance health via dependency audits and community adoption, though both projects need stronger formal security policies and automated scanning.

FOLLOW_UPS:

• What OpenSSF checks does tart need to improve?
• How often does tart receive security updates?
• Does applite publish any security advisories or policies?