The Pre-Round OSS Scan: From Repository Momentum to a Ranked Deal List

Sourcing an open source startup after it announces a round means you are already in a priced auction. This guide is a repeatable weekly scan for early-stage investors, platform and talent partners, and angels who want to reach company-backed open source founders while their repository is still climbing. It turns the whole ecosystem into a ranked, contactable pipeline, filtered so that source-available projects and bought stars never waste a call.

The method assembles four public building blocks that exist separately but were never joined into one procedure: relative-growth ranking, a license-class filter, a company-backing test, and a funding-status check. What follows is that assembly, in order, with thresholds, timings, and what a good result looks like at each stage.

Why the pre-round window is real and roughly twelve months wide

The window exists because startup GitHub activity is not flat. A peer-reviewed study by Conti, Peukert, and Roche, published in Organization Science, linked data on 160,065 US startups from Crunchbase to their activity on GitHub and found that startups accelerate their activity on the platform in the twelve months prior to raising their first financing round, and that the intensity of that involvement declines in the twelve months after.

That single finding shapes everything below. You are trying to catch a rising signal, not a risen one, which is why cadence matters. A quarterly leaderboard tells you who has already broken out. A weekly scan puts you in the accelerating phase, before the round is announced and the term sheet competition arrives.

The same study delivers the first filter for free. Investors do not react to cosmetic changes that startups add to the often nontechnical documentation of their codebase. Readme churn is not a signal. A commit graph can look busy while only documentation moves, so commit count alone overstates momentum. Weight code and pull request events, not raw commits.

There is a second reason the window closes fast. The adoption-to-revenue gap in open source is enormous, so the moment a project has commercial traction is not the moment it has revenue. MongoDB's S-1 states that Community Server had been downloaded over 30 million times since February 2009, against a base analysts pegged at more than 4,300 customers. That is roughly 0.01 percent penetration. Most open source companies monetize less than 5 percent of their download base, and in some cases less than 1 percent. Momentum shows up in the repository long before it shows up in a funding round.

What data sources you scan and what each proves

You scan three public sources, and each answers a different question. The GitHub event timeline tells you what is moving. The OSI and SPDX license lists tell you whether a project is fundable open source or defensive source-available. Public funding records tell you whether a company is still pre-round.

The GitHub event timeline is a record of the public GitHub activity stream, available as a BigQuery public dataset and through downloadable archives. It includes public issues, releases, stars, pull requests, and commits, is automatically updated every hour, and has archives available starting 12 February 2011. The BigQuery free tier processes one terabyte of data per month free of charge, which covers a trailing 90-day query if you select only the columns and event types you need.

For ranking logic, the ROSS Index published by Runa Capital is the reference. It ranks repositories by their maximum star growth rate over all 90-day periods ending within the target quarter, and the observation period can begin only when the repo has 1,000 or more stars. Runa built it around companies it invested in early, including n8n, Nginx, MariaDB, Twenty, and Mastra. For community-health signals, CHAOSS, the Linux Foundation's metrics project, supplies the definitions you use to separate real growth from vanity.

The scan, start to finish

Run the eight steps below in order. The ordering is deliberate: sources disagree, and the resolution matters. The academic signal implies leading with acceleration in activity, ROSS leads with star growth, and CHAOSS would lead with community-health filtering. Lead with growth-rank first and health-filter second, so you never try to health-score the whole of GitHub.

The full cycle runs in a day of analyst time in the first week and far less once the event query is automated. The judgement-heavy stages are backing confirmation and vanity discounting; budget your attention there.

Ranking on relative growth instead of totals

Rank on the maximum 90-day star growth rate among repos that have crossed 1,000 stars, never on total stars. Absolute counts favour old repos, so a five-year-old project with 40,000 stars will outrank a genuine breakout that is doubling.

This is the ROSS quarterly logic, and it exists for exactly this failure. ROSS itself switches to absolute new stars only for its annual report; for pre-round timing you want the relative rate, because relative growth is what correlates with the acceleration phase the academic study identified. The 1,000-star floor is not arbitrary either. It filters out the long tail of tiny repos where a single Hacker News post produces a growth rate that means nothing.

A caution about comparable lists: Accel launched Open100 in 2020 as a similar ranking but with no measurable methodology and no update period. A list you cannot reproduce or re-run on a schedule is a snapshot, not a pipeline. The value of this procedure is that you run it yourself, weekly, with thresholds you control.

A quarterly leaderboard tells you who has already broken out. A weekly scan puts you in the accelerating phase.

The license fork: OSI-open versus source-available

License class is a fundability fork, not a footnote. Trust the LICENSE file and its SPDX identifier, never the README, because a project can call itself open source while shipping a license that is not.

The Open Source Initiative defines open source through ten criteria, including free redistribution and source code that must be included or readily available. Permissive licenses like MIT and Apache 2.0 pass. Copyleft licenses like AGPLv3 pass too. Source-available licenses like the Business Source License, SSPL, and RSALv2 allow source inspection but impose restrictions, such as prohibiting commercial hosting, that make them non-OSI-compliant.

The moves tell a story. MongoDB relicensed to SSPL in October 2018. Redis abandoned the BSD license in favour of SSPL and RSALv2 on 20 March 2024. HashiCorp's Terraform, Couchbase, CockroachDB, and Sentry use BSL. Grafana Labs relicensed its core projects from Apache 2.0 to AGPLv3 in 2021. Companies trade OSI-compliance for monetization once a small fraction of downloads pay, so a source-available license usually signals a defensive posture from a company already thinking about capturing revenue, not the early community momentum you are hunting. Note the exception: BSL reverts to an open source license after a set period, often four years, and that eventual license must be GPL-compatible, so a young BSL project is not automatically disqualified but does deserve a closer read of intent.

Discounting vanity, confirming real momentum

Stars are the cheapest and most gamed metric, which is precisely why relative growth plus anomaly-flagging beats any raw leaderboard. CHAOSS explicitly classifies stars among vanity metrics. Confirm momentum with signals that are harder to fake.

Compute four things for each candidate:

• Contributor density per 1,000 stars. Total contributors normalized against stars. This is the denominator that exposes a bought star count, because bots add stars but not contributors.
• External pull request share. Cross-org PRs prove that people outside the company are building on the project, which is the community traction investors underwrite.
• 180-day contributor retention. Track early contributors, those who made their first contribution within the first 180 days of the repository's creation, and whether they stayed.
• Bus Factor, or Contributor Absence Factor. The smallest number of people who make 50 percent of contributions. A value of one or two means fragility, not a company.

Then run the star-authenticity test. Each starring event is evaluated against three signals: new account age, empty profile, and temporal burst. Events that trigger two or more of these are flagged as anomalous. If a large share of a repo's recent stars are anomalous, discard the repo regardless of its growth rate.

This is the stage where a scan earns its keep. A leaderboard hands you the top-left and top-right of that matrix mixed together. The four metrics above tell you which is which.

Resolving the founder behind a fast-moving repo is the slowest manual step, because a GitHub org handle is not a person and a maintainer is not always the founder. This is where Refolk removes friction: you describe the person by role, stage, and repository signal in plain English and get contactable founders back, so steps four and seven collapse into one query rather than an afternoon of cross-referencing.

How this goes wrong: seven false positives

Most of the value in this procedure is in what it rejects. Each failure mode below is a false positive that looks fundable until you run the stated check.

Two of these deserve extra weight. The post-raise trap is subtle because acceleration is exactly what you are looking for, and a hiring burst after a closed round produces the same commit surge. The academic finding that activity declines after funding is your defence, but only if you confirm no announced round before you reach out. The source-available trap is common because relicensing is a live trend; treat the LICENSE file as ground truth and the README as marketing.

The talent geography you will miss with a US-only scan

Run the scan across the US and Europe, not the US alone. Refolk's index of professional profiles shows the founder pool is real outside the US, and English-first leaderboards under-cover it.

number: 4.5x
label: US OSS founders versus the UK in Refolk's index
note: 256 founders tagged to open source in the US, against 61 in Germany and 57 in the UK.