A method relates to identifying, by a processing device, a plurality of source code objects associated with an open source product stored in a version-controlled code repository, determining a first subset of the plurality of source code objects associated with a respective commit identifier indicating that each of the first subset of the plurality of source code objects is committed to the version-controlled code repository, determining a second subset of the plurality of source code objects not associated with any commit identifier of the version-controlled code repository, labeling each of the first subset of the plurality of source code objects as an upstream source code object, and labeling each of the second subset of the plurality of source code objects as a non-upstream source code object.