PHP repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 85 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
coollabsio/coolify 1 adequate · 4 strong PHP 530,203 lines 62,480 2026-10-25 strong
phpoffice/phpspreadsheet 4 strong PHP 338,958 lines 14,003 2026-11-07 strong
php-cs-fixer/php-cs-fixer 2 adequate · 3 strong PHP 321,768 lines 13,573 2026-11-07 strong
spatie/laravel-permission 4 strong PHP 20,491 lines 12,982 2026-11-07 strong
appwrite/appwrite 2 adequate · 3 strong PHP 686,026 lines 57,482 2026-10-25 strong
ramsey/uuid 3 strong PHP 25,787 lines 12,632 2026-11-07 adequate
walkor/workerman 1 adequate · 3 strong PHP 16,510 lines 11,550 2026-11-07 strong
yourls/yourls 3 strong PHP 29,487 lines 12,298 2026-11-03 adequate
filamentphp/filament 2 adequate · 2 strong PHP 615,009 lines 32,142 2026-10-25 adequate
composer/composer 1 adequate · 3 strong PHP 154,635 lines 29,538 2026-10-25 strong
monicahq/monica 3 adequate · 2 strong PHP 220,725 lines 25,362 2026-10-25 adequate
firefly-iii/firefly-iii 2 adequate · 2 strong PHP 269,698 lines 24,785 2026-10-25 adequate
glpi-project/glpi 1 adequate · 4 strong PHP 1,843,812 lines 6,560 2026-11-05 strong
bagisto/bagisto 2 adequate · 3 strong PHP 584,647 lines 28,271 2026-10-23 strong
matomo-org/matomo 4 strong PHP 1,236,978 lines 21,899 2026-10-25 strong
humhub/humhub 1 adequate · 3 strong PHP 397,214 lines 6,775 2026-11-03 strong
bookstackapp/bookstack 2 adequate · 3 strong PHP 285,160 lines 19,056 2026-10-25 strong
flarum/framework 4 strong PHP 343,413 lines 6,767 2026-11-03 strong
krayin/laravel-crm 2 adequate · 2 strong PHP 160,166 lines 24,049 2026-10-23 adequate
aisingapore/tagui 2 adequate · 2 strong PHP 32,904 lines 6,340 2026-11-03 adequate
koel/koel 4 strong PHP 163,526 lines 17,266 2026-10-25 strong
freshrss/freshrss 4 adequate · 1 strong PHP 151,993 lines 16,158 2026-10-25 adequate
openemr/openemr 4 adequate · 1 strong PHP 1,735,504 lines 5,570 2026-11-03 adequate
getgrav/grav 1 adequate · 3 strong PHP 191,033 lines 15,673 2026-10-25 strong
shlinkio/shlink 1 adequate · 4 strong PHP 60,031 lines 5,401 2026-11-03 strong
joomla/joomla-cms 2 adequate · 2 strong PHP 604,148 lines 5,165 2026-11-03 adequate
grokability/snipe-it 2 adequate · 3 strong PHP 728,753 lines 14,978 2026-10-25 strong
dokuwiki/dokuwiki 4 strong PHP 263,396 lines 4,734 2026-11-03 strong
wallabag/wallabag 2 adequate · 3 strong PHP 83,995 lines 12,989 2026-10-25 strong
opensourcepos/opensourcepos 4 adequate · 1 strong PHP 158,985 lines 4,481 2026-11-03 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.