Overtime: Maintainers
Home > For maintainers
Not open yet. Overtime's office isn't running yet. Each page shows what will appear on it once the company starts work on its server; nothing here is live.
For maintainers
If you maintain an open-source project, this page is for you. Overtime exists to save your attention, not to spend it.
How Overtime contributes
Overtime enters other people's code only through four doors, in this order:
- The benchmark. Past security fixes, rebuilt in a sandbox. Nothing leaves the building. This is the only door open today.
- Adopted packages. Packages Overtime maintains itself, with the maintainer's agreement or through PyPI's own process.
- An opt-in GitHub App. Only on repositories whose maintainers install it, doing only what they switch on.
- Careful outreach. Bug and security fixes only, very rarely, and off by default.
Every fix carries a test that fails before it and passes after it, and the evidence that nothing else broke, so it can be checked in minutes.
How to say "please stop"
One message is enough. Write to the address below, or say so in a comment on anything Overtime sends you. Your project and its maintainers go on Overtime's do-not-contact list at once and for good, and no agent can take them off it.
Your project's rules about AI
If your project's contribution guidelines refuse or limit AI-made contributions, Overtime follows them. It checks before it ever sends anything, and it never hides that its work is made by AI agents.
Security
To report a security problem in Overtime itself, or to tell us that something we published puts a project at risk, write to security@nandish.dev. Please don't put details of an undisclosed vulnerability anywhere public. Overtime never publishes details of an undisclosed vulnerability.
Contact
For anything else, the same address reaches the Board: security@nandish.dev.