The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
pydantic/pydantic 4 strong Python 251,442 lines 28,889 2026-10-25 strong
prometheus-operator/prometheus-operator 5 strong Go 235,978 lines 9,994 2026-11-03 strong
mattermost/mattermost 3 adequate · 2 strong TypeScript 2,141,621 lines 39,409 2026-10-22 adequate
hcengineering/platform 3 adequate · 2 strong TypeScript 976,972 lines 27,822 2026-10-25 adequate
openebs/openebs 2 adequate · 2 strong — 30,791 lines 9,842 2026-11-03 adequate
postgrest/postgrest 1 adequate · 3 strong Haskell 70,201 lines 27,685 2026-10-25 strong
streamaserver/streama 3 adequate · 2 strong JavaScript 116,195 lines 9,820 2026-11-03 adequate
rustfs/rustfs 3 adequate · 2 strong Rust 1,777,063 lines 35,306 2026-10-23 adequate
owasp-modsecurity/modsecurity 3 adequate · 1 strong C++ 129,365 lines 9,852 2026-11-03 adequate
celery/celery 2 adequate · 3 strong Python 120,842 lines 28,919 2026-10-25 strong
sillytavern/sillytavern 3 adequate · 2 strong JavaScript 242,902 lines 34,854 2026-10-23 adequate
hugoblox/kit 2 adequate · 2 strong HTML 70,001 lines 9,785 2026-11-03 adequate
anchore/syft 3 adequate · 1 strong Go 580,029 lines 9,819 2026-11-03 adequate
mlflow/mlflow 3 adequate · 2 strong Python 1,682,961 lines 28,136 2026-10-25 adequate
portainer/portainer 3 adequate · 2 strong TypeScript 485,620 lines 38,704 2026-10-22 adequate
ggreer/the_silver_searcher 1 adequate · 2 strong C 9,215 lines 27,130 2026-10-25 adequate
reviewdog/reviewdog 1 adequate · 4 strong Go 28,892 lines 9,716 2026-11-03 strong
wpscanteam/wpscan 2 adequate · 2 strong Ruby 237,075 lines 9,832 2026-11-03 adequate
modem-dev/hunk 2 adequate · 3 strong TypeScript 399,621 lines 9,746 2026-11-03 strong
aquasecurity/trivy 3 adequate · 2 strong Go 355,517 lines 38,620 2026-10-22 adequate
ghostfolio/ghostfolio 3 adequate · 2 strong TypeScript 176,242 lines 9,644 2026-11-03 adequate
tabbyml/tabby 3 adequate · 1 strong Rust 165,247 lines 33,924 2026-10-23 adequate
locustio/locust 2 adequate · 3 strong Python 47,291 lines 28,183 2026-10-25 strong
pythagora-io/gpt-pilot 2 adequate · 3 strong Python 39,965 lines 33,645 2026-10-23 adequate
apache/kafka 3 adequate · 2 strong Java 1,760,892 lines 34,107 2026-10-23 adequate
iofficeai/aionui 5 adequate TypeScript 399,087 lines 33,727 2026-10-23 adequate
tokio-rs/axum 2 adequate · 2 strong Rust 57,171 lines 27,258 2026-10-25 adequate
gethomepage/homepage 1 adequate · 4 strong JavaScript 143,266 lines 33,324 2026-10-23 strong
libuv/libuv 3 strong C 120,178 lines 27,212 2026-10-25 adequate
valkey-io/valkey 1 adequate · 4 strong C 582,581 lines 27,314 2026-10-25 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.