C repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 44 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
gojue/ecapture 3 adequate · 2 strong C 72,767 lines 15,516 2026-10-23 adequate
semgrep/semgrep 1 adequate · 3 strong C 1,526,065 lines 17,186 2026-10-22 strong
haiwen/seafile 2 adequate · 1 strong C 61,594 lines 15,371 2026-10-23 adequate
libvips/libvips 3 adequate · 1 strong C 286,565 lines 11,697 2026-10-25 adequate
fluent/fluent-bit 4 adequate · 1 strong C 2,468,208 lines 8,174 2026-10-28 adequate
cilium/pwru 5 adequate C 112,818 lines 3,847 2026-11-03 adequate
sqlite/sqlite 1 adequate · 2 strong C 550,555 lines 10,540 2026-10-25 adequate
htop-dev/htop 1 adequate · 1 strong C 51,845 lines 8,353 2026-10-25 adequate
yugabyte/yugabyte-db 3 adequate · 2 strong C 2,421,340 lines 10,617 2026-10-22 adequate
madler/zlib 3 adequate · 1 strong C 60,730 lines 7,108 2026-10-25 adequate
pgbackrest/pgbackrest 1 adequate · 3 strong C 215,770 lines 4,462 2026-10-28 strong
codeberg.org/dnkl/fuzzel 3 adequate · 1 strong C 28,463 lines 925 2026-11-07 adequate
codeberg.org/grunfink/snac2 4 adequate · 1 strong C 36,941 lines 571 2026-11-07 adequate
codeberg.org/dnkl/foot 3 adequate · 1 strong C 63,483 lines 2,234 2026-10-25 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.