Go repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 316 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
uptrace/uptrace 3 adequate · 2 strong Go 118,493 lines 4,306 2026-10-23 adequate
octelium/octelium 2 adequate · 3 strong Go 391,302 lines 4,112 2026-10-23 strong
codeberg.org/superseriousbusiness/gotosocial 3 adequate · 2 strong Go 396,660 lines 669 2026-11-08 adequate
gmwalletapp/epusdt 3 adequate · 2 strong Go 43,160 lines 3,920 2026-10-23 adequate
owncloud/ocis 2 adequate · 3 strong Go 652,310 lines 2,171 2026-10-28 strong
pgrok/pgrok 1 adequate · 4 strong Go 6,159 lines 3,645 2026-10-23 strong
deepfence/secretscanner 1 adequate · 3 strong Go 2,911 lines 3,401 2026-10-23 strong
datazip-inc/olake 2 adequate · 3 strong Go 129,636 lines 1,571 2026-10-28 strong
victoriametrics/victorialogs 2 adequate · 3 strong Go 252,099 lines 2,399 2026-10-23 strong
kubernetes-sigs/aws-iam-authenticator 2 adequate · 3 strong Go 19,135 lines 2,338 2026-10-23 strong
betterleaks/betterleaks 2 adequate · 3 strong Go 101,331 lines 2,322 2026-10-23 strong
notifuse/notifuse 4 adequate · 1 strong Go 772,541 lines 2,273 2026-10-23 adequate
koordinator-sh/koordinator 4 adequate · 1 strong Go 479,419 lines 1,765 2026-10-23 adequate
gitea.com/gitea/tea 2 adequate · 2 strong Go 35,678 lines 272 2026-11-07 adequate
codeberg.org/emersion/soju 2 adequate · 3 strong Go 24,899 lines 230 2026-11-08 strong
codeberg.org/codeberg/pages-server 3 adequate · 2 strong Go 6,699 lines 389 2026-10-25 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.