C++ repositories reading strong

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 14 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
godotengine/godot 1 adequate · 3 strong C++ 2,023,533 lines 117,764 2026-10-25 strong
keepassxreboot/keepassxc 1 adequate · 3 strong C++ 158,750 lines 28,949 2026-10-25 strong
dragonflydb/dragonfly 2 adequate · 3 strong C++ 348,384 lines 31,816 2026-10-23 strong
typesense/typesense 2 adequate · 3 strong C++ 289,731 lines 27,026 2026-10-22 strong
osquery/osquery 4 strong C++ 439,256 lines 23,669 2026-10-23 strong
esphome/esphome 2 adequate · 3 strong C++ 857,176 lines 11,722 2026-10-25 strong
domoticz/domoticz 2 adequate · 3 strong C++ 481,546 lines 3,829 2026-11-03 strong
vesoft-inc/nebula 1 adequate · 4 strong C++ 427,390 lines 12,443 2026-10-23 strong
manticoresoftware/manticoresearch 1 adequate · 3 strong C++ 653,246 lines 12,067 2026-10-23 strong
redpanda-data/redpanda 2 adequate · 3 strong C++ 1,452,495 lines 12,631 2026-10-22 strong
heavyai/heavydb 2 adequate · 3 strong C++ 869,449 lines 3,120 2026-11-03 strong
wasmedge/wasmedge 4 strong C++ 331,558 lines 10,844 2026-10-23 strong
griddb/griddb 2 adequate · 3 strong C++ 988,535 lines 2,473 2026-11-03 strong
firebase/firebase-ios-sdk 1 adequate · 3 strong C++ 816,312 lines 6,980 2026-10-23 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.