Repositories reading adequate
Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.
| Repository | Language | Size | Stars | Read | Band |
|---|---|---|---|---|---|
| jhy/jsoup 3 strong | Java | 66,660 lines | 11,402 | 2026-10-25 | |
| kumahq/kuma 3 adequate · 2 strong | Go | 790,571 lines | 4,015 | 2026-11-03 | |
| kyantech/palmr 4 adequate · 1 strong | TypeScript | 111,183 lines | 2,395 | 2026-11-08 | |
| mrkai77/loop 3 adequate · 1 strong | Swift | 36,815 lines | 11,707 | 2026-10-25 | |
| hashicorp/packer 2 adequate · 2 strong | Go | 95,277 lines | 15,812 | 2026-10-22 | |
| apache/shardingsphere-elasticjob 1 adequate · 2 strong | Java | 74,591 lines | 8,197 | 2026-10-28 | |
| browserbox/browserbox 3 adequate | Shell | 17,334 lines | 3,931 | 2026-11-03 | |
| fluent/fluent-bit 4 adequate · 1 strong | C | 2,468,208 lines | 8,174 | 2026-10-28 | |
| emdash-cms/emdash 3 adequate · 2 strong | TypeScript | 1,271,053 lines | 13,904 | 2026-10-23 | |
| piwigo/piwigo 2 adequate · 1 strong | PHP | 370,686 lines | 3,881 | 2026-11-03 | |
| omniauth/omniauth 1 adequate · 2 strong | Ruby | 8,251 lines | 8,106 | 2026-10-28 | |
| opensearch-project/opensearch 3 adequate · 2 strong | Java | 1,960,045 lines | 13,900 | 2026-10-23 | |
| tracecathq/tracecat 4 adequate · 1 strong | Python | 1,333,224 lines | 3,887 | 2026-11-03 | |
| cilium/pwru 5 adequate | C | 112,818 lines | 3,847 | 2026-11-03 | |
| supertokens/supertokens-core 2 adequate · 2 strong | Java | 255,454 lines | 15,333 | 2026-10-22 | |
| 1backend/1backend 3 adequate · 2 strong | Go | 284,568 lines | 2,355 | 2026-11-07 | |
| searx/searx 4 adequate · 1 strong | Python | 42,397 lines | 13,558 | 2026-10-23 | |
| trykimu/videoeditor 3 adequate · 2 strong | TypeScript | 26,693 lines | 2,285 | 2026-11-08 | |
| instill-ai/instill-core 3 adequate · 2 strong | Python | 64,120 lines | 2,320 | 2026-11-07 | |
| scipag/vulscan 2 adequate | Lua | 2,178 lines | 3,793 | 2026-11-03 | |
| sqlite/sqlite 1 adequate · 2 strong | C | 550,555 lines | 10,540 | 2026-10-25 | |
| gogf/gf 2 adequate · 2 strong | Go | 609,547 lines | 13,287 | 2026-10-23 | |
| serde-rs/serde 1 adequate · 2 strong | Rust | 43,784 lines | 10,831 | 2026-10-25 | |
| cocoalumberjack/cocoalumberjack 3 strong | Objective-C | 44,885 lines | 13,318 | 2026-10-23 | |
| portkey-ai/gateway 4 adequate · 1 strong | TypeScript | 107,020 lines | 13,259 | 2026-10-23 | |
| tstack/lnav 3 adequate · 2 strong | C++ | 480,460 lines | 10,716 | 2026-10-25 | |
| polyaxon/polyaxon 3 adequate | MDX | 3,131 lines | 3,748 | 2026-11-03 | |
| debezium/debezium 2 adequate · 2 strong | Java | 642,270 lines | 13,266 | 2026-10-23 | |
| akuity/kargo 5 adequate | Go | 563,773 lines | 3,754 | 2026-11-03 | |
| logto-io/logto 3 adequate · 2 strong | TypeScript | 639,179 lines | 14,750 | 2026-10-22 |
What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.
How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.