Ruby repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 45 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
zammad/zammad 3 adequate · 2 strong Ruby 1,134,488 lines 5,972 2026-10-25 adequate
decidim/decidim 1 adequate · 4 strong Ruby 907,688 lines 1,846 2026-11-03 strong
solidusio/solidus 1 adequate · 4 strong Ruby 240,711 lines 5,336 2026-10-25 strong
rack/rack 1 adequate · 2 strong Ruby 25,462 lines 5,132 2026-10-25 adequate
lobsters/lobsters 2 adequate · 3 strong Ruby 31,848 lines 4,845 2026-10-25 strong
doorkeeper-gem/doorkeeper 4 strong Ruby 44,636 lines 5,531 2026-10-23 strong
sharetribe/sharetribe 3 adequate · 2 strong Ruby 412,940 lines 2,448 2026-10-28 adequate
flippercloud/flipper 3 adequate · 2 strong Ruby 45,795 lines 3,973 2026-10-23 adequate
rubygems/rubygems.org 3 adequate · 2 strong Ruby 114,212 lines 2,441 2026-10-25 adequate
fetlife/rollout 1 adequate · 3 strong Ruby 6,774 lines 2,904 2026-10-23 strong
pay-rails/pay 4 strong Ruby 87,300 lines 2,263 2026-10-23 strong
natlabrockies/api-umbrella 1 adequate · 3 strong Ruby 111,781 lines 2,203 2026-10-23 strong
avo-hq/avo 2 adequate · 3 strong Ruby 100,302 lines 1,812 2026-10-23 strong
multiwoven/multiwoven 3 adequate · 2 strong Ruby 84,771 lines 1,683 2026-10-23 adequate
openfoodfoundation/openfoodnetwork 2 adequate · 3 strong Ruby 501,787 lines 1,286 2026-10-25 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.