PHP repositories reading strong
Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.
| Repository | Language | Size | Stars | Read | Band |
|---|---|---|---|---|---|
| phpbb/phpbb 4 strong | PHP | 389,658 lines | 2,107 | 2026-11-03 | |
| dolibarr/dolibarr 2 adequate · 3 strong | PHP | 1,516,686 lines | 7,761 | 2026-10-22 | |
| part-db/part-db-server 2 adequate · 3 strong | PHP | 204,138 lines | 1,826 | 2026-11-03 | |
| passbolt/passbolt_api 2 adequate · 3 strong | PHP | 481,336 lines | 6,185 | 2026-10-23 | |
| spatie/laravel-backup 4 strong | PHP | 13,692 lines | 6,026 | 2026-10-23 | |
| archtechx/tenancy 2 adequate · 3 strong | PHP | 34,010 lines | 4,425 | 2026-10-23 | |
| lunarphp/lunar 1 adequate · 3 strong | PHP | 145,979 lines | 3,763 | 2026-10-23 | |
| shopware/shopware 5 strong | PHP | 2,123,507 lines | 3,454 | 2026-10-23 | |
| getkirby/kirby 1 adequate · 3 strong | PHP | 382,331 lines | 1,535 | 2026-10-25 | |
| always-open/laravel-totem 2 adequate · 3 strong | PHP | 17,071 lines | 1,813 | 2026-10-23 |
What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.
How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.