Shell repositories

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 14 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
ohmyzsh/ohmyzsh 2 adequate · 2 strong Shell 97,594 lines 189,923 2026-10-25 adequate
pi-hole/pi-hole 2 adequate · 2 strong Shell 10,631 lines 61,119 2026-10-25 adequate
acmesh-official/acme.sh 2 adequate · 1 strong Shell 71,134 lines 47,773 2026-10-25 adequate
longhorn/longhorn 2 adequate · 2 strong Shell 79,599 lines 8,051 2026-11-03 adequate
cisofy/lynis 1 adequate · 3 strong Shell 5,446 lines 16,576 2026-10-28 strong
onlyoffice/documentserver 3 adequate Shell 10,879 lines 7,082 2026-11-03 adequate
tj/n 2 strong Shell 2,747 lines 19,510 2026-10-25 adequate
browserbox/browserbox 3 adequate Shell 17,334 lines 3,931 2026-11-03 adequate
zilliztech/attu 2 adequate · 1 strong Shell 1,675 lines 3,230 2026-11-03 adequate
complianceascode/content 1 adequate · 4 strong Shell 692,059 lines 2,833 2026-11-03 strong
getsentry/self-hosted 5 adequate Shell 9,230 lines 9,621 2026-10-22 adequate
automazeio/ccpm 1 adequate · 1 strong Shell 2,970 lines 8,412 2026-10-23 adequate
e-m-b-a/emba 5 adequate Shell 79,358 lines 3,720 2026-10-23 adequate
pfelk/pfelk 3 adequate · 1 strong Shell 3,632 lines 1,222 2026-10-23 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.