The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
composer/composer 1 adequate · 3 strong PHP 154,635 lines 29,538 2026-10-25 strong
khoj-ai/khoj 4 adequate · 1 strong Python 94,568 lines 37,799 2026-10-23 adequate
icewhaletech/casaos 2 adequate · 3 strong Go 15,752 lines 37,362 2026-10-23 adequate
gabime/spdlog 1 adequate · 2 strong C++ 34,721 lines 29,644 2026-10-25 adequate
koreader/koreader 2 adequate · 3 strong Lua 235,459 lines 30,020 2026-10-25 strong
firecracker-microvm/firecracker 1 adequate · 4 strong Rust 228,438 lines 37,583 2026-10-23 strong
jitsi/jitsi-meet 5 adequate TypeScript 404,655 lines 30,010 2026-10-25 adequate
notepad-plus-plus/notepad-plus-plus 2 adequate · 2 strong C++ 481,205 lines 29,447 2026-10-25 adequate
glanceapp/glance 4 adequate · 1 strong Go 19,829 lines 37,640 2026-10-23 adequate
reacherhq/check-if-email-exists 3 adequate · 2 strong Rust 15,458 lines 10,404 2026-11-03 adequate
signalapp/signal-android 2 adequate · 2 strong Kotlin 909,283 lines 29,391 2026-10-25 adequate
falkordb/falkordb 1 adequate · 3 strong Rust 272,760 lines 10,502 2026-11-03 strong
rxhanson/rectangle 1 adequate · 3 strong Swift 35,697 lines 29,982 2026-10-25 strong
typeorm/typeorm 2 adequate · 3 strong TypeScript 334,851 lines 36,659 2026-10-23 strong
lightpanda-io/browser 2 adequate · 3 strong Zig 384,571 lines 36,914 2026-10-23 strong
anuken/mindustry 3 adequate · 1 strong Java 321,895 lines 29,111 2026-10-25 adequate
copilotkit/openbot 3 adequate · 2 strong TypeScript 1,161,748 lines 10,300 2026-11-03 adequate
bpftrace/bpftrace 3 strong C++ 144,592 lines 10,402 2026-11-03 adequate
appsmithorg/appsmith 4 adequate · 1 strong TypeScript 1,679,190 lines 41,105 2026-10-22 adequate
restic/restic 4 adequate · 1 strong Go 103,491 lines 36,753 2026-10-23 adequate
pingcap/tidb 2 adequate · 3 strong Go 2,035,379 lines 40,670 2026-10-22 strong
agentscope-ai/qwenpaw 3 adequate · 2 strong Python 1,658,503 lines 36,012 2026-10-23 adequate
authelia/authelia 1 adequate · 4 strong Go 428,966 lines 29,142 2026-10-25 strong
karakeep-app/karakeep 3 adequate · 2 strong TypeScript 411,629 lines 29,381 2026-10-25 adequate
webtorrent/webtorrent-desktop 1 adequate · 2 strong JavaScript 12,251 lines 10,144 2026-11-03 adequate
frappe/erpnext 4 strong Python 1,013,840 lines 40,460 2026-10-22 strong
plausible/analytics 2 adequate · 3 strong Elixir 353,331 lines 29,217 2026-10-25 strong
keepassxreboot/keepassxc 1 adequate · 3 strong C++ 158,750 lines 28,949 2026-10-25 strong
evolution-foundation/evolution-api 2 adequate · 3 strong TypeScript 43,849 lines 10,026 2026-11-03 adequate
kong/insomnia 3 adequate · 2 strong TypeScript 311,699 lines 40,072 2026-10-22 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.