Evidence ledger
22 sources
Checked 14 Oct 2026
Evidence ledger
One row per claim in Everything that survived has someone else's name on it: ten years of Lyft's platform: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Field guide: Everything that survived has someone else's name on it: ten years of Lyft's platform.
Research date 2026-10-14. All artefacts were retrieved in-session, either by anonymous git clone
--filter=blob:none of the public repository (commit SHAs below are from those clones) or by HTTP
fetch of the registry endpoint shown.
Corpus boundary. This session's egress policy resolved only github.com,
raw.githubusercontent.com, pypi.org, registry.npmjs.org, proxy.golang.org, pkg.go.dev,
repo1.maven.org and hub.docker.com. eng.lyft.com, lyft.github.io, clutch.sh, conference
and paper hosts were all unreachable, so there is no engineering-blog, talk, paper or financial
evidence in this guide, and none is implied.
| # | Org | Artefact | Tier | Published | Checked | URL | Claim taken from it | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Envoy project | Security postmortem for CVE-2019-9900, CVE-2019-9901 | postmortem | 2019-04-23 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/security/postmortems/cve-2019-9900.md | A routing/authorisation bypass came from two views of the same header string | "Envoy viewed header strings with a mixture of c_str() and string_view, allowing the possibility of inconsistent views between checks and resulting action." |
| 2 | Envoy project | Same postmortem, process section | postmortem | 2019-04-23 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/security/postmortems/cve-2019-9900.md | The first run of the security process was itself the finding | "This was the first time in which the Envoy security release process was followed and provided a learning opportunity to refine the process, originally borrowed from the Kubernetes project, to Envoy's requirements." |
| 3 | Envoy project | Security postmortem for CVE-2019-15225, CVE-2019-15226 | postmortem | 2019-11-11 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/security/postmortems/cve-2019-15225.md | Attacker-controlled input met an algorithm with unbounded cost | "Envoy used the libstdc++ std::regex implementation ... an HTTP request with sufficiently large header values may consume large amounts of stack memory and cause abnormal process termination ... This appeared when matching header values of 16Kb or more." |
| 4 | Envoy project | Same postmortem, resolution | postmortem | 2019-11-11 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/security/postmortems/cve-2019-15225.md | The fix was to delete the general mechanism, not to bound it | "Envoy 1.11.2 deprecates the use of std::regex in user facing paths. A new safe regex matcher introduces an explicitly configurable regex engine. Currently, the regex engine is limited to Google's RE2 regex engine" |
| 5 | Envoy project | security/postmortem-template.md (blameless template), added commit 3a8128a8 |
adr | 2019-04-17 | 2026-10-14 | https://github.com/envoyproxy/envoy/commit/3a8128a8189a65c2f156eaea5bcb14ac50166ed9 | The project institutionalised postmortems in April 2019 and has published none since 2019 | Template header: "Slimmed down template from: Betsy Beyer, Chris Jones, Jennifer Petoff, and Niall Richard Murphy. 'Site Reliability Engineering.'" ; security/ directory's last substantive commit is 2020-08-31 |
| 6 | Envoy project | EXTENSION_POLICY.md |
adr | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/EXTENSION_POLICY.md | An extension in a shared project needs a staffed sponsor and two reviewers, or it is removable | "All extensions must be sponsored by an existing maintainer ... It makes sure that incentives are aligned and that extensions are not added to the repo without sufficient thought put into future maintenance." and "This starts a 6 month deprecation interval, after which extension is decommissioned." |
| 7 | Envoy project | api/API_VERSIONING.md |
adr | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/api/API_VERSIONING.md | The configuration contract a consumer inherits is versioned by the project, not the consumer | "The Envoy project and xDS working group take API stability and versioning seriously ... Each package is independently versioned with a protobuf semantic versioning scheme" |
| 8 | Envoy project | Initial commit | source | 2016-08-08 | 2026-10-14 | https://github.com/envoyproxy/envoy/commit/a714b9c2b0a2acc9da44098cabff69586134a0dd | Envoy's public history starts 2016-08-08 | git log --reverse: 2016-08-08 a714b9c2b0 Matt Klein Initial commit |
| 9 | Envoy project | docs/intro/arch_overview/dynamo.rst at commit bdaf31a4 (2016) |
source | 2016-12-22 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/bdaf31a47617f4588e08b8b8517570a439fa1377/docs/intro/arch_overview/dynamo.rst | Lyft put application-protocol knowledge into the proxy and said so in the shared project's docs | "At Lyft we use this filter for all application communication with DynamoDB. It provides an invaluable source of data agnostic to the application platform and specific AWS SDK in use." |
| 10 | Envoy project | docs/intro/arch_overview/global_rate_limiting.rst at commit bdaf31a4 |
source | 2016-12-22 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/bdaf31a47617f4588e08b8b8517570a439fa1377/docs/intro/arch_overview/global_rate_limiting.rst | Why a central rate-limit service rather than per-host circuit breaking, and who wrote the implementation | "The most common case is when a large number of hosts are forwarding to a small number of hosts and the average request latency is low ... Lyft provides a reference implementation written in Go which uses a Redis backend." |
| 11 | Envoy project | dynamo: moving to contrib (#21715) |
source | 2022-06-16 | 2026-10-14 | https://github.com/envoyproxy/envoy/commit/352857fb678fd7063e82884d8b675b6cc816e563 | Lyft's own filter was demoted out of core by a non-Lyft maintainer in June 2022 | Commit author alyssawilk <alyssar@chromium.org>; files move from source/extensions/filters/http/dynamo to contrib/dynamo/filters/http/source |
| 12 | Envoy project | MongoDB proxy, BSON depth limit | source | 2026-07-10 | 2026-10-14 | https://github.com/envoyproxy/envoy/commit/fa68fb65fd52289ba01cd26363a6c17e382a2bb5 | The other Lyft-era protocol filter stayed in core and is still being hardened by others | Add depth limit of 128 for BSON document parsing (#45214), in source/extensions/filters/network/mongo_proxy |
| 13 | Envoy project | OWNERS.md at HEAD |
source | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/35ef062c73bdadd2cb64a3837e54dcb0f490e34b/OWNERS.md | Every lyft.com address in Envoy governance now sits under Emeritus or Friends; the founder remains, with a personal address | Section map: # Emeritus maintainers (line 108) contains 7 @lyft.com entries; # Friends of Envoy (line 134) contains 1; # Senior maintainers lists Matt Klein ... (mattklein123@gmail.com) |
| 14 | Envoy project | OWNERS.md at commit 06d62d5c (2017) |
source | 2017 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/envoy/06d62d5c67ccec06bb5c3f1985683fcd542945a2/OWNERS.md | In 2017 Lyft held the senior maintainer seat and five further owner entries | Entries: Matt Klein ... (mklein@lyft.com), ccaramanolis@lyft.com, jnino@lyft.com, dhochman@lyft.com, rdzhabarov@lyft.com, bgallagher@lyft.com |
| 15 | Lyft | lyft/discovery README at archive commit |
source | 2021-10-14 | 2026-10-14 | https://raw.githubusercontent.com/lyft/discovery/c7eb20f1437b96629b4edaff118dd763aadbfe27/README.md | The pre-xDS registry: a Flask service over DynamoDB with host heartbeats, weights and a canary flag, polled by Envoy | "⚠️ This repository has been archived and is no longer accepting contributions ⚠️" ; "HOST_TTL ... Default value is 600 (10 minutes)" ; "port on which the host expects connections, Envoy will connect to this port" |
| 16 | Lyft | lyft/discovery archive notice commit |
source | 2021-10-14 | 2026-10-14 | https://github.com/lyft/discovery/commit/c7eb20f1437b96629b4edaff118dd763aadbfe27 | The registry was retired with a one-line README banner, five years after Envoy shipped | archive notice (#49), the repository's 29th and last commit |
| 17 | Lyft | lyft/metadataproxy README at HEAD |
source | last commit 2021-09-16 | 2026-10-14 | https://raw.githubusercontent.com/lyft/metadataproxy/57045cb730a60ba7f3ee8ec2b7f953dcc3175f10/README.md | A pre-platform credential shim, left running with no deprecation notice at all | "The metadataproxy is used to allow containers to acquire IAM roles ... allowing you to provide scoped IAM roles to individual containers" ; no archive banner present, last commit 2021-09-16 |
| 18 | Lyft | lyft/confidant archiving announcement |
source | 2025-02-14 | 2026-10-14 | https://raw.githubusercontent.com/lyft/confidant/0185b8b8ef54dfd26666a144be80b242fda0df6f/docs/root/archiving_announcement.md | Dated, explicit retirement of the in-house secret store | "As of 02/14/2025, the repository has been marked as archived and read-only ... The existing releases will continue to be available for download, but no new features or updates will be developed." |
| 19 | Lyft | lyft/clutch archival announcement |
source | 2025-04-14 | 2026-10-14 | https://github.com/lyft/clutch/commit/b0bb7a16779f8daef15a1bca8eff6fdea004c02f | The operator-facing platform was retired two months after the secret store, after 2,036 commits | "Please be advised that this repository is slated to be deprecated and will be marked as archived and read-only ... please reach out to clutch@lyft.com." |
| 20 | Lyft | lyft/gostats idle-pruning commit |
source | 2026-10-08 | 2026-10-14 | https://github.com/lyft/gostats/commit/1b83075e292e0e17028beba78fad619be32cf39b | Ten years in, the stats library had unbounded memory growth under per-request tag values; the fix is opt-in | "statStore keeps every unique counter/timer/gauge name it has ever seen for the life of the process, with no eviction ... grows memory without limit" ; "GOSTATS_PRUNE_IDLE_SECONDS (default: unset, disabled)" ; "BenchmarkCardinalityFlood |
| 21 | Envoy project | envoyproxy/ratelimit README, API deprecation history |
source | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/envoyproxy/ratelimit/f4e76690d9ce6590707ffd7d28c33a24b99302da/README.md | Lyft's rate-limit service is now an Envoy-project repository, and its protocol has been cut twice | Module github.com/envoyproxy/ratelimit ; "v1.0.0 tagged on commit 0ded92a2.... Ratelimit has been in production use at Lyft for over 2 years." ; "4bb32826 deleted support for legacy v2 rls.proto" |
| 22 | Envoy project | ratelimit legacy-protocol removal commits |
source | 2020-07-01 and 2021-08-03 | 2026-10-14 | https://github.com/envoyproxy/ratelimit/commit/4bb32826997cba76f8f3f193b9eef5762de0d175 | Two forced migrations for every operator, dated | e91321b1 2020-07-01 Drop support for legacy ratelimit.proto and upgrade to v3 rls.proto (#153) ; 4bb32826 2021-08-03 Remove support for legacy v2 api (#278) |
| 23 | Envoy project | envoy-mobile move notice |
source | 2022-12-02 | 2026-10-14 | https://github.com/envoyproxy/envoy-mobile/commit/a9ce5f854d789a9d95d53f8ed3a0f3e4013b7671 | The mobile data plane was absorbed into the main repository after 1,794 commits | docs: add note to README about project being moved to the Envoy repo (#2715), the repository's last commit |
| 24 | Flyte project | flyteorg/flyte README at HEAD |
source | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/flyteorg/flyte/cafacafc25c234c53417bea54aa3779b66d52e1c/README.md | The generation Lyft built is now the legacy branch of a vendor-led product | "Flyte 2 is now generally available!" with a Union.ai announcement link ; "Looking for Flyte 1? Go to the master branch, where Flyte 1 is now maintained." |
| 25 | Flyte project | Flyte 2 backend cutover commit | source | 2026-04-28 | 2026-10-14 | https://github.com/flyteorg/flyte/commit/1dd046406db056f08d27adf2299d2527be9bdffb | The donated project replaced its backend and IDL under new stewards | Flyte 2: Cut over to Flyte 2 new backend implementation (#6583) ; CODEOWNERS at HEAD assigns * to @flyteorg/flyte2-contributors |
| 26 | Buf | bufbuild/protoc-gen-validate README at HEAD |
source | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/bufbuild/protoc-gen-validate/414042a5ff2e98dc47f8161937316a25b1da5bba/README.md | Lyft's validator is now Buf's, in maintenance mode, superseded by Buf's own rewrite | "protoc-gen-validate (PGV) has reached a stable state and is in maintenance mode. We recommend that new and existing projects transition to using protovalidate." |
| 27 | Buf | Add deprecation flag to generation (#1381) |
source | 2026-05-27 | 2026-10-14 | https://github.com/bufbuild/protoc-gen-validate/commit/7489dc6fb68d7df198e72c8fdef3525f42199f75 | The deprecation is being compiled into generated code, under the new owner | Commit title, on the repository whose last commit is 2026-05-28 |
| 28 | Cartography project | CNCF added to the docs | adr | 2024-10-23 | 2026-10-14 | https://github.com/lyft/cartography/commit/fd9b0e9afb531be57506ded152cb374cad117d30 | The one Lyft-origin project still growing moved to a foundation in late 2024 | Add CNCF to docs (#1369), followed by Add initial governance guidelines (#1372) on 2024-11-03 |
| 29 | Cartography project | README at HEAD, under the cartography-cncf org |
source | checked at HEAD 2026-10-14 | 2026-10-14 | https://raw.githubusercontent.com/cartography-cncf/cartography/master/README.md | The canonical repository is now cartography-cncf/cartography; lyft/cartography redirects |
OpenSSF badge URL .../github.com/cartography-cncf/cartography/badge ; PyPI metadata gives Repository: https://github.com/cartography-cncf/cartography |
| 30 | PyPI | confidant project metadata |
source | release 7.0.0, 2025-02-14 | 2026-10-14 | https://pypi.org/project/confidant/ | The archive shipped as a package release, and the summary now carries the deprecation | summary: 'DEPRECATED: A secret management system and client.' ; 35 releases, first 2016-09-02, last 7.0.0 2025-02-14 (JSON API) |
| 31 | PyPI | confidant-client project metadata |
source | release 2.7.1, 2025-03-18 | 2026-10-14 | https://pypi.org/project/confidant-client/ | The client was published a month after the server repository was archived | 32 releases, last 2.7.1 on 2025-03-18 (JSON API) |
| 32 | Docker Hub | lyft/confidant tags |
source | last tag 2020-12-21 | 2026-10-14 | https://hub.docker.com/v2/repositories/lyft/confidant/tags | The container distribution stopped four years and two months before the archive notice | 16 tags; latest last updated 2020-12-21; last version tag 6.3.0 2020-07-10 |
| 33 | Docker Hub | envoyproxy/ratelimit tags |
source | latest 2026-10-06 | 2026-10-14 | https://hub.docker.com/v2/repositories/envoyproxy/ratelimit/tags | The donated service is still being built and published continuously | 260 tags; most recent master / f4e76690 updated 2026-10-06 |
| 34 | PyPI | amundsen-databuilder, amundsen-frontend, amundsen-metadata |
source | last releases 2024 | 2026-10-14 | https://pypi.org/project/amundsen-databuilder/ | The data-discovery project stopped shipping in 2024 and carries no deprecation notice | amundsen-databuilder last 7.5.1 2024-08-14; amundsen-frontend last 4.3.0 2024-03-06; amundsen-metadata last 3.13.0 2024-03-06 |
| 35 | npm | @clutch-sh/core |
source | last publish 2025-04-14 | 2026-10-14 | https://registry.npmjs.org/@clutch-sh/core | Clutch published 1,994 versions and stopped on the day of the archival announcement | First 0.0.0-20200719221738-bc215b84fbad 2020-07-20; last 4.0.0-beta.20250414105557 2025-04-14 |
| 36 | Go module proxy | github.com/lyft/gostats version list |
source | checked 2026-10-14 | 2026-10-14 | https://proxy.golang.org/github.com/lyft/gostats/@v/list | The stats library kept its lyft/ module path for a decade |
54 versions, highest v0.4.9 |
| 37 | pkg.go.dev | github.com/lyft/goruntime |
source | v0.3.0, 2022-09-08 | 2026-10-14 | https://pkg.go.dev/github.com/lyft/goruntime | The config plane was a filesystem of one-value files, shared in design with Envoy's runtime | Package doc: feature flags, kill switches, regional settings, experiment settings; loader, snapshot and refresher; latest v0.3.0 published September 8, 2022 |
| 38 | Maven Central | io.envoyproxy.protoc-gen-validate:pgv-java |
source | last listed 0.6.13, 2022-10-03 | 2026-10-14 | https://repo1.maven.org/maven2/io/envoyproxy/protoc-gen-validate/pgv-java/ | The Java artefacts of Lyft's validator are published under the Envoy project's group id | Directory listing: 0.1.0 2019-06-13 through 0.6.13 2022-10-03 |
Derived measurements
Computed in-session from the cloned histories; the method is stated in the guide because it
undercounts. git log --date=format:%Y --format='%ad|%ae', tallied by year, counting an author
address ending in lyft.com.
| Repository | Commits in clone | Window | lyft.com-addressed commits by year |
|---|---|---|---|
| envoyproxy/envoy | 29,150 | 2016-08-08 to 2026-10-14 | 2016: 62/235, 2017: 172/1271, 2018: 151/1749, 2019: 230/2950, 2020: 226/3433, 2021: 264/3265, 2022: 95/3745, 2023: 2/3626, 2024: 1/3359, 2025: 0/2507, 2026: 0/3010 |
| flyteorg/flyte | 5,253 | 2019-04-09 to 2026-10-12 | 2019: 267/367, 2020: 390/735, 2021: 11/1077, 2022: 1/929, 2023 onward: 0 |
| amundsen-io/amundsen | 2,713 | 2019-02-04 to 2026-09-10 | 2019: 217/638, 2020: 89/1149, 2021: 41/607, 2022: 6/196, 2023: 7/80, 2024: 3/40, 2025: 0/1, 2026: 0/2 |
| envoyproxy/envoy-mobile | 1,794 | 2019-03-04 to 2022-12-02 | 2019: 71/379, 2020: 42/418, 2021: 70/501, 2022: 25/496 |
| bufbuild/protoc-gen-validate | 591 | 2017-10-03 to 2026-05-28 | never above 4 in a year |
Matt Klein's commits to Envoy by year and address: 2016: 125 @users.noreply, 3 @lyft.com,
3 @outlook.com; 2017: 206 / 93; 2018: 119 @lyft.com, 9 @gmail.com; 2019: 76 / 36;
2020: 101 @lyft.com; 2021: 70; 2022: 39; 2023: 1 @lyft.com and 1 @gmail.com;
2025: 1 @gmail.com; 2026: 1 @gmail.com.
Lyft-kept repositories, from the same clones: lyft/discovery 29 commits (2016-08-14 to
2021-10-14), lyft/metadataproxy 169 (2016-03-02 to 2021-09-16), lyft/confidant 451
(2015-10-08 to 2025-02-14), lyft/clutch 2,036 (2020-07-18 to 2025-04-14), lyft/goruntime 32
(2017-01-26 to 2022-09-08), lyft/gostats 112 (2016-12-28 to 2026-10-08),
lyft/protoc-gen-star 67 (2017-09-06 to 2025-03-17), cartography 2,196 (2019-03-01 to
2026-10-13, of which 430 in 2025 and 921 in 2026), envoyproxy/ratelimit 359 (2017-01-30 to
2026-10-06).
What the corpus cannot show
- Lyft's internal deployment: how many services run the sidecar, request volumes, instance counts, cost. No reachable artefact carries a figure.
- Why each retirement happened. The archive notices give dates and wording, never reasons; the
only internal references are opaque ticket ids (
SECFOUND-4018on the Confidant archive,OBSX-1114on the gostats fix). - What replaced Confidant, Clutch and the metadata proxy inside Lyft. Inferred candidates are marked as inference in the guide, never as report.
- Whether Lyft still runs Envoy, ratelimit or Flyte at all. Contribution is not operation, and the corpus measures only the former.