The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate Significant findings 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
umami-software/umami 3 adequate · 3 strong TypeScript 258,912 lines 39,009 2026-10-25 adequate
getpelican/pelican 1 adequate · 4 strong Python 32,441 lines 13,363 2026-11-03 strong
run-llama/llama_index 4 adequate · 2 strong Python 9,665 lines 52,621 2026-10-22 adequate
prisma/orm 1 significant · 2 adequate · 3 strong TypeScript 1,661,335 lines 47,664 2026-10-23 significant findings
apache/airflow 3 adequate · 3 strong Python 1,898,197 lines 47,267 2026-10-23 adequate
tailscale/tailscale 2 adequate · 4 strong Go 649,868 lines 36,994 2026-10-25 strong
siyuan-note/siyuan 4 adequate · 2 strong TypeScript 1,109,533 lines 46,899 2026-10-23 adequate
mpv-player/mpv 2 adequate · 2 strong C 272,141 lines 37,136 2026-10-25 adequate
serverless/serverless 1 significant · 4 adequate · 1 strong JavaScript 444,709 lines 46,921 2026-10-23 significant findings
searxng/searxng 5 adequate · 1 strong Python 93,914 lines 37,800 2026-10-25 adequate
run-llama/liteparse 1 significant · 4 adequate · 1 strong Rust 85,613 lines 12,975 2026-11-03 significant findings
tldraw/tldraw 3 adequate · 3 strong TypeScript 795,440 lines 51,043 2026-10-22 adequate
ceuilisa/pixiv-shaft 1 adequate · 3 strong Kotlin 304,782 lines 8,260 2026-11-07 adequate
herdrdev/herdr 1 significant · 3 strong Rust 387,249 lines 45,521 2026-10-23 significant findings
keycloak/keycloak 3 adequate · 3 strong Java 1,659,357 lines 36,999 2026-10-25 adequate
apify/crawlee 2 adequate · 4 strong TypeScript 181,805 lines 26,278 2026-10-28 strong
grapesjs/grapesjs 2 adequate · 3 strong TypeScript 110,620 lines 26,348 2026-10-28 adequate
imputnet/cobalt 1 significant · 4 adequate · 1 strong Svelte 31,526 lines 45,389 2026-10-23 significant findings
juspay/hyperswitch 4 adequate · 2 strong Rust 1,795,493 lines 45,400 2026-10-23 adequate
jqlang/jq 2 adequate · 3 strong C 53,774 lines 35,703 2026-10-25 adequate
reactive-resume/reactive-resume 3 adequate · 3 strong TypeScript 479,667 lines 44,763 2026-10-23 adequate
hashicorp/vault 4 adequate · 2 strong Go 1,105,396 lines 36,317 2026-10-25 adequate
react-hook-form/react-hook-form 3 adequate · 2 strong TypeScript 100,595 lines 44,878 2026-10-23 adequate
tracer-cloud/opensre 3 adequate · 3 strong Python 654,321 lines 12,684 2026-11-03 adequate
langchain-ai/langgraph 2 adequate · 3 strong Python 213,940 lines 43,789 2026-10-23 strong
sdwebimage/sdwebimage 1 significant · 1 adequate · 2 strong Objective-C 40,633 lines 25,614 2026-10-28 significant findings
bishopfox/sliver 5 adequate · 1 strong Go 386,022 lines 12,222 2026-11-03 adequate
casey/just 1 adequate · 3 strong Rust 76,062 lines 36,039 2026-10-25 strong
clockworklabs/spacetimedb 3 adequate · 3 strong Rust 977,666 lines 25,399 2026-10-28 adequate
raysan5/raylib 2 adequate · 1 strong C 397,357 lines 34,876 2026-10-25 adequate

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.