Audacity is the audio editor most people reach for first. Record from a microphone or the computer's own output, cut, copy and rearrange clips on a multi-track timeline, and clean up the result with noise reduction, normalisation, compression and EQ, then export to WAV, MP3, FLAC or OGG. It is just as at home trimming a podcast as digitising old tapes.
The repository now holds Audacity 4, a rebuilt interface on a new framework, at 4.0.1 when scanned; the 3.x line lives on a separate branch. Plugins in VST3, LV2, Nyquist and other formats extend it, and the project is backed by Muse Group, which also maintains MuseScore.
About 18,800 stars on GitHub, though its real audience is far bigger, since most people download it from audacityteam.org. It is GPLv3 for the program as a whole, with most source files GPLv2-or-later. It is a destructive-by-default editor rather than a full music studio: for MIDI-heavy production, a DAW is the better fit.
- Repository: github.com/audacity/audacity
- Licence: custom (Other)
- Language: C++. Stars: 18.8K. Forks: 2,700. Last push: Oct 26, 2026.
- Scan: safe, Oct 26, 2026, commit 59385b0
Who it is for
Podcasters, teachers, musicians tidying a recording, and anyone who needs to cut, clean or convert audio without paying for an editor.
Getting started
1. macOS (Homebrew)
brew install --cask audacity2. Windows (winget)
winget install Audacity.Audacity3. Linux (Flathub)
flatpak install flathub org.audacityteam.AudacityOrdinary installers are on audacityteam.org. Building Audacity 4 from source follows BUILDING.md on the master branch; Audacity 3.x builds from the audacity3 branch.
Safety scan
We cloned audacity/audacity at commit 59385b0 on Oct 26, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secrets, no suspicious code patterns and no bare-IP URLs. Most of the 2.2 million lines the scanner counted as TypeScript are Qt translation files in share/locale, which share the .ts extension; the program itself is C++.
- The three binaries flagged as JAR files are share/workspaces/*.mws, small zip-format files that store the Classic, Modern and Music window layouts.
- The installer scripts are build-machine setup (buildscripts/ci/linux/setup.sh uses sudo to install packages on CI runners), translation tooling and an AppImage hook that registers a URL handler. None pipes a download into a shell.
- The code mentions audio.com, Muse Group's service for sharing and saving projects online. It is optional and only used if you sign in and choose it.
- No lockfile the scanner could read, so it did not look up known advisories for the C++ libraries. 14 workflows, none using pull_request_target; 3 of 20 third-party actions pinned to a commit. Dependabot, contributing guide and code of conduct present; no security policy. OpenSSF Scorecard 4.8.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 6 installer scripts (one can call sudo) |
| Committed binaries | 3 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 14 workflows. None use pull_request_target. 17 of 20 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often forum.audacityteam.org, www.gnu.org, www.audacityteam.org, github.com. No URLs to bare IP addresses. |
| Known vulnerabilities | No lockfile to check: dependencies are declared as ranges, so what gets installed is whatever is current on the day. |
| Project hygiene | Has automated dependency updates, licence file, contributing guide. Missing security policy, CodeQL. |
| OpenSSF Scorecard | 4.8 out of 10, as of Oct 19, 2026. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Installer scripts (6)
- au3/linux/AppImage/apprun-hooks/install-url-handler.sh, 38 lines; talks to github.com
- buildscripts/ci/linux/setup.sh, 172 lines, uses sudo
- buildscripts/ci/macos/setup.sh, 27 lines
- buildscripts/ci/tools/run_testflow_case.sh, 41 lines
- buildscripts/tools/run_testflow.sh, 45 lines
- tools/translations/run_lupdate.sh, 101 lines; talks to www.gnu.org
Committed binaries (3)
share/workspaces/Music.mws: JAR, 5 KBshare/workspaces/Classic.mws: JAR, 5 KBshare/workspaces/Modern.mws: JAR, 4 KB
By the numbers
| Stars | 18.8K |
|---|---|
| Forks | 2,700 |
| Contributors | 319 |
| Commits | 25.7K |
| Open issues | 1,796 |
| Open pull requests | 108 |
| Releases | 67 |
| Latest release | Audacity-4.0.1 |
| Licence | custom |
| Main language | C++ |
| Project age | 11 years |
| Last push | Oct 26, 2026 |
| Tracked files | 5,218 |
| Lines of code | 2.3M |
| Checkout size | 198 MB |
Lines by language: TypeScript 1.6M, C++ 431.9K, C/C++ header 184.7K, Python 4,299, CMake 3,108, Objective-C++ 2,463.
Questions
Is Audacity free?
Yes. Audacity is free and open source under the GPL, with no ads, no account and no paid version. Optional online features from audio.com have their own terms.
Does Audacity collect data?
Not in the background. It can check for updates and offers optional audio.com sharing, and error reports are sent only if you agree when one comes up. The scan found no hidden tracking.
What is new in Audacity 4?
A rebuilt interface and a new underlying framework, shared with MuseScore. The project describes the master branch as undergoing major structural change, so if you rely on a 3.x plugin or workflow, check it before upgrading; 3.x installers remain available.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.