Week 45, updated 2 Nov 2026

Coding agents Aider

Is Aider safe?

Short answer: Caution. StackGrade's weekly scan of Aider-AI/aider gives it a Caution label for 18 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 142 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Aider is exploitable in your setup. Automated scan of commit 5dc9490 on 2 Nov 2026, not a manual audit.

Updated : the last week its score, rank or safety result changed.

AI pair programming in your terminal that edits code in your local git repo.

  • 49,889 stars
  • pushed 22 May
  • Apache-2.0
  • Python

github.com/Aider-AI/aider · aider.chat

31score out of 100

#45of 52 overall#12in Coding agents▲ 1 vs Week 44

  • Maintenance 30%27
  • Adoption 30%36
  • Docs 20%29
  • Community 20%–
W42W43W44W45

Score over the last 4 weeks: 30, 30, 30, 31.

Caution

18 critical-severity known vulnerabilities in runtime dependencies (OSV).

How this score works

Each part is a percentile among all 52 tracked tools, so 50 is average for this list. Community is not measured yet; the score uses the other 80%.

  • Maintenance: Last push 22 May 2026. Last 10 GitHub releases within 188 days, counted as 0 because the latest is older than 180 days, latest release 12 Feb 2026. Median 4.9 h to close an issue (48 closed issues).
  • Adoption: 49,889 stars (70%), 5,125 forks (30%).
  • Docs: README 12,328 characters, 19 headings, 1 code blocks, install section: yes.

Methodology

#12 of 14 in Coding agents

Ranked by score. The yellow row is this tool.

Coding agents, Week 45score 0–100, safety
  1. 1Gemini CLI#4 overall70Caution
  2. 2OpenCode#5 overall70No issues found
  3. 3OpenHands#10 overall68Caution
  4. 4Claude Code#11 overall65No dependencies scanned
  5. 5Cline#12 overall65Caution
  6. 6Codex#16 overall58Caution
  7. 7deepseek-harness#17 overall57Caution
  8. 8KiroCrew#27 overall52Caution
  9. 9magpie#28 overall51No issues found
  10. 10Continue#43 overall37Caution
  11. 11goose#44 overall36Caution
  12. 12Aider#45 overall31Caution
Show the other 2
  1. 13codex-plugin-cc#48 overall29No issues found
  2. 14Roo Code#51 overall23Caution

Safety scan, 2 Nov 2026

Automated scan of commit 5dc9490, 365 files. Not a manual audit.

Caution

  • 18Critical dependency advisories142 high, 73 medium, 10 low. OSV, runtime dependencies only.
  • 0Install hooksNo npm install scripts found.
  • 0Remote-code patternsFor example eval(fetch(…)).
  • 0Agent files checked0 phrases flagged for review.
  • 3curl | sh installersIn docs or program code. Information only.
Why this label?

Why this label:

  • 18 critical-severity known vulnerabilities in runtime dependencies (OSV)

Known vulnerabilities in runtime dependencies (OSV): 18 critical, 142 high, 73 medium, 10 low, 2 unrated

  • aiohttp@3.13.3 (PYSEC-2026-2102) in requirements.txt
  • anyio@4.12.1 (PYSEC-2026-4025) in requirements.txt
  • certifi@2026.2.25 (PYSEC-2026-4320) in requirements.txt
  • gitpython@3.1.46 (PYSEC-2026-2161) in requirements.txt
  • gitpython@3.1.46 (PYSEC-2026-3786) in requirements.txt

Also found (informational, does not change the label):

  • 142 high-severity known vulnerabilities in runtime dependencies (OSV)
  • Documents curl|sh style installer (3 occurrences, e.g. aider/website/_posts/2025-01-15-uv.md)
  • Critical advisories counted once per package: 34 matches across 3 lockfiles

Notes:

  • 14 affected packages only in dev/test/docs manifests, not counted
  • Telemetry/analytics references in code: mixpanel, posthog

Automated scan of commit 5dc9490 on 2 Nov 2026, not a manual audit. 365 files checked. What we check

Repo activity

From the GitHub API, fetched 2 Nov 2026.

  • 0Releases, 90 daysLatest v0.86.3.dev, 12 Feb
  • 5hMedian issue closeOver 48 closed issues
  • 49.9kStars+135 since 26 Oct
  • 5.1kForks1,947 open issues
  • 2023Repo created9 May 2023
30 days ago2 Nov
0 releases in the last 30 days, one mark each (GitHub releases feed, last 10 entries).

0 releases in the last 30 days (GitHub releases feed, last 10 entries).

Questions about Aider

Answers use this week's StackGrade data.

Is Aider safe to use?

Caution. StackGrade's weekly scan of Aider-AI/aider gives it a Caution label for 18 critical-severity known vulnerabilities in runtime dependencies (OSV). It does list 142 high-severity advisories in runtime dependencies, which don't change the label. Critical advisories are counted once per package; a known issue in a locked package version does not prove Aider is exploitable in your setup. Automated scan of commit 5dc9490 on 2 Nov 2026, not a manual audit.

How does StackGrade score Aider?

Aider scores 31 out of 100 in Week 45: #45 of 52 tracked tools overall and #12 in Coding agents. The score combines maintenance (27), adoption (36) and docs (29) as percentiles among all 52 tracked tools; community (20% weight) is not measured yet, so the score uses the other 80%. It is not a hands-on test and it is separate from the safety label.

What are the alternatives to Aider?

The highest-scored other tools in Coding agents this week: Gemini CLI (70, Caution), OpenCode (70, No issues found), OpenHands (68, Caution), Claude Code (65, No dependencies scanned). StackGrade has not tested them hands-on.

What licence does Aider use?

The licence listed for Aider-AI/aider is Apache-2.0. Read the licence text before commercial use.

Compare and use it

All facts and sources
Type
AI tool
License
Apache-2.0
Language
Python
Created
9 May 2023
Owner
Aider-AI (Organization)
Forks
5,125
Homepage
aider.chat

GitHub description: “aider is AI pair programming in your terminal”

Sources: github.com/Aider-AI/aider, api.github.com/repos/Aider-AI/aider, raw.githubusercontent.com/Aider-AI/aider/main/README.md. Fetched 2 Nov 2026.

Know when Aider changes label

One email a week: the new top 10, the biggest score changes and every safety label that changed.

Free. Double opt-in: you confirm by email first, unsubscribe in one click.