Python repositories
Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.
| Repository | Language | Size | Stars | Read | Band |
|---|---|---|---|---|---|
| teamwiseflow/xiaobei 4 adequate · 1 strong | Python | 130,977 lines | 8,684 | 2026-11-03 | |
| pycqa/bandit 1 adequate · 3 strong | Python | 27,519 lines | 8,369 | 2026-11-03 | |
| zilliztech/deep-searcher 2 adequate · 3 strong | Python | 25,355 lines | 8,367 | 2026-11-03 | |
| suitenumerique/docs 1 adequate · 4 strong | Python | 177,768 lines | 16,953 | 2026-10-28 | |
| prefecthq/prefect 2 adequate · 3 strong | Python | 946,356 lines | 23,936 | 2026-10-25 | |
| reflex-dev/reflex 2 adequate · 3 strong | Python | 467,491 lines | 28,977 | 2026-10-23 | |
| repowise-dev/repowise 2 adequate · 3 strong | Python | 1,688,885 lines | 8,120 | 2026-11-03 | |
| saleor/saleor 3 adequate · 2 strong | Python | 877,042 lines | 23,509 | 2026-10-25 | |
| getredash/redash 3 adequate · 2 strong | Python | 105,080 lines | 28,845 | 2026-10-23 | |
| hacs/integration 2 adequate · 2 strong | Python | 40,087 lines | 7,869 | 2026-11-03 | |
| netbox-community/netbox 1 adequate · 4 strong | Python | 348,585 lines | 21,611 | 2026-10-25 | |
| deepset-ai/haystack 2 adequate · 2 strong | Python | 1,685,337 lines | 26,818 | 2026-10-23 | |
| persepolisdm/persepolis 3 adequate · 1 strong | Python | 23,366 lines | 7,489 | 2026-11-03 | |
| traceloop/openllmetry 2 adequate · 2 strong | Python | 376,531 lines | 7,518 | 2026-11-03 | |
| wagtail/wagtail 2 adequate · 3 strong | Python | 419,102 lines | 20,507 | 2026-10-25 | |
| clearml/clearml 2 adequate · 2 strong | Python | 262,814 lines | 6,928 | 2026-11-03 | |
| infobyte/faraday 3 adequate · 2 strong | Python | 90,000 lines | 6,838 | 2026-11-03 | |
| mai-with-u/maibot 2 adequate · 3 strong | Python | 588,507 lines | 6,833 | 2026-11-03 | |
| openshot/openshot-qt 3 strong | Python | 166,622 lines | 6,739 | 2026-11-03 | |
| data-centric-ai-community/fg-data-profiling 4 strong | Python | 29,057 lines | 13,744 | 2026-10-28 | |
| goauthentik/authentik 2 adequate · 3 strong | Python | 661,040 lines | 26,050 | 2026-10-22 | |
| oomol-lab/pdf-craft 2 adequate · 2 strong | Python | 117,364 lines | 6,481 | 2026-11-03 | |
| comet-ml/opik 4 adequate · 1 strong | Python | 1,701,022 lines | 22,852 | 2026-10-23 | |
| pallets/click 4 strong | Python | 39,748 lines | 17,770 | 2026-10-25 | |
| datahub-project/datahub 4 adequate · 1 strong | Python | 1,931,589 lines | 12,909 | 2026-10-28 | |
| aimhubio/aim 4 adequate · 1 strong | Python | 152,228 lines | 6,291 | 2026-11-03 | |
| browser-act/skills 2 adequate · 1 strong | Python | 34,024 lines | 6,315 | 2026-11-03 | |
| cloud-custodian/cloud-custodian 2 adequate · 2 strong | Python | 1,236,225 lines | 6,103 | 2026-11-03 | |
| aio-libs/aiohttp 1 adequate · 3 strong | Python | 113,313 lines | 16,567 | 2026-10-25 | |
| arize-ai/phoenix 3 adequate · 2 strong | Python | 1,468,800 lines | 12,041 | 2026-10-28 |
What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.
How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.