PHP repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 85 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
dolibarr/dolibarr 2 adequate · 3 strong PHP 1,516,686 lines 7,761 2026-10-22 strong
part-db/part-db-server 2 adequate · 3 strong PHP 204,138 lines 1,826 2026-11-03 strong
passbolt/passbolt_api 2 adequate · 3 strong PHP 481,336 lines 6,185 2026-10-23 strong
kimai/kimai 3 adequate · 2 strong PHP 195,110 lines 5,046 2026-10-25 adequate
spatie/laravel-backup 4 strong PHP 13,692 lines 6,026 2026-10-23 strong
easysoft/zentaopms 3 adequate · 2 strong PHP 1,726,170 lines 1,715 2026-11-03 adequate
freescout-help-desk/freescout 3 adequate · 1 strong PHP 265,962 lines 4,582 2026-10-25 adequate
tirrenotechnologies/tirreno 3 strong PHP 151,213 lines 1,562 2026-11-03 adequate
webonyx/graphql-php 3 strong PHP 102,983 lines 4,711 2026-10-23 adequate
archtechx/tenancy 2 adequate · 3 strong PHP 34,010 lines 4,425 2026-10-23 strong
area17/twill 1 adequate · 3 strong PHP 123,299 lines 3,971 2026-10-23 strong
opnform/opnform 3 adequate · 2 strong PHP 251,550 lines 3,986 2026-10-23 adequate
pimcore/pimcore 1 adequate · 3 strong PHP 331,211 lines 3,879 2026-10-23 adequate
lunarphp/lunar 1 adequate · 3 strong PHP 145,979 lines 3,763 2026-10-23 strong
espocrm/espocrm 2 adequate · 2 strong PHP 854,588 lines 3,513 2026-10-23 adequate
shopware/shopware 5 strong PHP 2,123,507 lines 3,454 2026-10-23 strong
tenancy/multi-tenant 1 adequate · 2 strong PHP 13,441 lines 2,601 2026-10-23 adequate
moonshine-software/moonshine 3 adequate · 1 strong PHP 95,134 lines 1,305 2026-10-28 adequate
mettle/sendportal 2 adequate · 1 strong PHP 8,652 lines 2,180 2026-10-23 adequate
apioo/fusio 1 adequate · 2 strong PHP 2,819 lines 2,128 2026-10-23 adequate
getkirby/kirby 1 adequate · 3 strong PHP 382,331 lines 1,535 2026-10-25 strong
always-open/laravel-totem 2 adequate · 3 strong PHP 17,071 lines 1,813 2026-10-23 strong
relaticle/relaticle 1 adequate · 4 strong PHP 457,689 lines 1,777 2026-10-23 adequate
faveosuite/faveo-helpdesk 2 adequate · 2 strong PHP 442,911 lines 1,255 2026-10-23 adequate
combodo/itop 2 adequate · 2 strong PHP 1,068,884 lines 1,207 2026-10-23 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.