A real report, on two real repositories
Run on 2026-08-15 by the same pipeline your order goes through, against the live GitHub API. Nothing on this page is staged, estimated, or hand-edited: every count is read from merged pull requests, their reviews, their merge actor, and their timestamps.
facebook/react
A repository where independent review is enforced · branch main
- Changes in the population
- 53
- Exceptions
- 0
- Undetermined merge actor
- 0
Exceptions, by rule
- Merged without an independent approval0
- Merged with zero approving reviews0
- Merged before the approval timestamp0
Advisory — reported separately, never added to the exception count
- No linked issue reference35
Zero exceptions across all 53 changes. That is the result branch protection with required independent review produces, and it is worth paying for: the deliverable here is the defensible population and the written statement of how it was derived — which is what the auditor asked for in the first place.
markwhiting/workbot
Our own repository, which merges on green CI with no human approver · branch main
- Changes in the population
- 106
- Exceptions
- 185
- Undetermined merge actor
- 0
Exceptions, by rule
- Merged without an independent approval91
- Merged with zero approving reviews94
- Merged before the approval timestamp0
Advisory — reported separately, never added to the exception count
- No linked issue reference51
94 of the 106 changes reached main with no approving review, and 91 were merged by their own author with nobody else approving. Most changes broke both rules, which is why 185 exceptions sit on 106 changes. This is our own repository and we publish it because it is the honest end of the range: a small team that auto-merges on passing CI produces exactly this.
How these numbers were produced
Run on 2026-08-15 against the live GitHub API by the same pipeline a paying customer's report comes from. Every count is read from merged pull requests, their reviews, their merge actor, and their timestamps. No model produced any figure on this page.
The population is every pull request merged into the repository's default branch (main) inside the scanned window. It is the whole population, not a sample — each change was checked against every rule.
A single change can break more than one rule, so the exception total can be larger than the population. That is expected, not an error: 185 exceptions across 106 changes means many changes broke two rules at once.
- The scanned window is a recent slice of history, not a calendar audit period. A paid run scans the exact window you choose.
- changeproof reports what a repository's own review history records. It is not an audit and not an opinion on whether you pass a control.
- 'No linked issue' is reported on its own and is never added to the exception count. It fires on repositories that legitimately track work outside the issue tracker, and on bot-authored changes.
The rules, in full
Exceptions
- Merged without an independent approval
- The author of the change also merged it, and no reviewer other than the author approved it. This is the segregation-of-duties exception a SOC 2 CC8.1 or SOX change-management sample is looking for.
- Merged with zero approving reviews
- The change reached the default branch with no approving review recorded on it at all.
- Merged before the approval timestamp
- An independent approval exists, but the merge timestamp is earlier than it — the approval landed after the change was already in.
Advisory — never added to the exception count
- No linked issue reference
- Neither the title nor the body references an issue or ticket. Reported on its own because it fires on repositories that legitimately track work elsewhere, and on bot-authored changes.
Reading a zero
facebook/react came back with no exceptions at all. That is what enforced branch protection with required independent review produces, and it is a result worth having in writing: the fieldwork request opens by asking for a complete population of production changes and an account of how it was derived, and that is exactly what the report hands over. changeproof will never suggest that findings are universal — that would not be true.