PHP repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 85 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
openemr/openemr 4 adequate · 1 strong PHP 1,735,504 lines 5,570 2026-11-03 adequate
shlinkio/shlink 1 adequate · 4 strong PHP 60,031 lines 5,401 2026-11-03 strong
invoiceplane/invoiceplane 4 adequate · 1 strong PHP 81,028 lines 3,244 2026-11-08 adequate
joomla/joomla-cms 2 adequate · 2 strong PHP 604,148 lines 5,165 2026-11-03 adequate
grokability/snipe-it 2 adequate · 3 strong PHP 728,753 lines 14,978 2026-10-25 strong
dokuwiki/dokuwiki 4 strong PHP 263,396 lines 4,734 2026-11-03 strong
wallabag/wallabag 2 adequate · 3 strong PHP 83,995 lines 12,989 2026-10-25 strong
paymenter/paymenter 4 adequate · 1 strong PHP 71,207 lines 2,819 2026-11-07 adequate
laravel/cashier-stripe 3 strong PHP 19,973 lines 2,548 2026-11-08 adequate
leantime/leantime 2 adequate · 3 strong PHP 333,396 lines 11,965 2026-10-25 strong
qloapps/qloapps 3 adequate · 1 strong PHP 734,862 lines 14,445 2026-10-23 adequate
piwigo/piwigo 2 adequate · 1 strong PHP 370,686 lines 3,881 2026-11-03 adequate
akaunting/akaunting 2 adequate · 2 strong PHP 283,087 lines 10,153 2026-10-25 adequate
magento/magento2 1 adequate · 3 strong PHP 2,296,887 lines 12,211 2026-10-23 strong
octobercms/october 2 adequate · 2 strong PHP 403,338 lines 11,148 2026-10-23 adequate
mautic/mautic 2 adequate · 3 strong PHP 701,569 lines 10,830 2026-10-23 strong
nextcloud/all-in-one 5 adequate PHP 37,833 lines 10,702 2026-10-23 adequate
fossbilling/fossbilling 2 adequate · 3 strong PHP 231,595 lines 1,721 2026-11-07 strong
kanboard/kanboard 3 adequate · 2 strong PHP 233,925 lines 9,928 2026-10-23 adequate
open-web-analytics/open-web-analytics 4 strong PHP 219,212 lines 2,697 2026-11-03 strong
linuxserver/heimdall 1 adequate · 4 strong PHP 61,924 lines 9,365 2026-10-23 strong
prestashop/prestashop 1 adequate · 4 strong PHP 1,368,776 lines 9,234 2026-10-23 strong
fecshop/yii2_fecshop 2 adequate · 1 strong PHP 283,206 lines 5,261 2026-10-28 adequate
pixelfed/pixelfed 2 adequate · 3 strong PHP 363,724 lines 7,116 2026-10-25 strong
sylius/sylius 2 adequate · 3 strong PHP 622,568 lines 8,562 2026-10-23 strong
phpbb/phpbb 4 strong PHP 389,658 lines 2,107 2026-11-03 strong
projectsend/projectsend 3 adequate · 2 strong PHP 227,159 lines 2,045 2026-11-03 adequate
beikeshop/beikeshop 3 adequate · 2 strong PHP 163,016 lines 1,986 2026-11-03 adequate
laravel/jetstream 3 strong PHP 19,907 lines 4,059 2026-10-28 adequate
dolibarr/dolibarr 2 adequate · 3 strong PHP 1,516,686 lines 7,761 2026-10-22 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.