How STACKHOLDER works

How scanning works

A scan reads a public GitHub repository's dependency manifests and lockfiles, plus the software bill of materials GitHub publishes for it when one is available. Repository code is never executed and nothing is installed.

Each scan records the exact commit it read, so a graph can always be traced back to a specific state of the repository. Stage progress reflects real server work — no artificial delays.

Mapping verification

A mapping links a package, service or platform to the company that publishes or operates it, and states the relationship type: owned by, operated by, published by, or commercial dependency.

Every mapping carries a confidence score, a verification status and a public evidence link. Verified means a documented source supports the claim. Probable means the link is well-supported but indirect. Community proposed means it is awaiting review, and disputed means it is contested.

Anyone can propose a correction with a rationale and an evidence URL. Reviews are recorded with version history so changes are auditable.

Stock Tokens

Tokens are read from Robinhood's official catalogue on Robinhood Chain. Nothing is hardcoded. Tokens can be adjusted by corporate actions through an on-chain multiplier, so displayed balances apply the current multiplier rather than raw token amounts.

Amounts are handled as integer base units end to end. Rounding is explicit and shown before you sign anything.

Machine pension

You register an agent, connect its earnings — reported by you, observed on-chain, or delivered by a signed webhook — and write a policy: what share of earnings is contributed, when contributions are triggered and how they are allocated.

By default every contribution is a transaction you sign yourself. STACKHOLDER never holds your funds and never has custody of a key.

Eligibility and limits

Stock Token availability depends on your jurisdiction and the issuer's own rules. Where a purchase is not available to you, the interface disables the action and explains why instead of failing silently.

STACKHOLDER is not investment advice and does not manage money on your behalf. A stack-derived allocation describes your technical dependencies, not a recommendation.

Security

STACKHOLDER never asks for a private key or seed phrase, and no interface will ever request one. Wallet ownership is proven by signing a short one-time message.

Scans are rate limited, restricted to github.com, size-bounded, and guarded against server-side request forgery and path traversal.