I don't think there is another paper - that's the only one linked from their participation portal. The grandiose claims and lack of documented process make me very skeptical here. I've done some similar analysis as part of acquisitions, and almost all of the work was in ensuring data quality - did I actually cover every repo everyone commits to, does a person use multiple git configs with different emails, etc.