C repositories reading strong
Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.
| Repository | Language | Size | Stars | Read | Band |
|---|---|---|---|---|---|
| jqlang/jq 1 adequate · 3 strong | C | 53,774 lines | 35,703 | 2026-11-07 | |
| redis/redis 2 adequate · 3 strong | C | 549,207 lines | 76,478 | 2026-10-25 | |
| sumatrapdfreader/sumatrapdf 1 adequate · 3 strong | C | 2,359,429 lines | 17,915 | 2026-11-03 | |
| libgit2/libgit2 4 strong | C | 438,392 lines | 10,612 | 2026-11-08 | |
| curl/curl 1 adequate · 3 strong | C | 469,729 lines | 42,929 | 2026-10-25 | |
| valkey-io/valkey 1 adequate · 4 strong | C | 582,581 lines | 27,314 | 2026-10-25 | |
| taosdata/tdengine 2 adequate · 3 strong | C | 1,958,618 lines | 25,169 | 2026-10-23 | |
| ossec/ossec-hids 2 adequate · 3 strong | C | 255,581 lines | 5,070 | 2026-11-03 | |
| semgrep/semgrep 1 adequate · 3 strong | C | 1,526,065 lines | 17,186 | 2026-10-22 | |
| pgbackrest/pgbackrest 1 adequate · 3 strong | C | 215,770 lines | 4,462 | 2026-10-28 | |
| openssh/openssh-portable 1 adequate · 3 strong | C | 223,772 lines | 4,055 | 2026-10-23 |
What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.
How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.