The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
steel-dev/steel-browser 2 adequate · 3 strong TypeScript 54,989 lines 7,916 2026-11-03 strong
evidentlyai/evidently 4 adequate · 1 strong Jupyter Notebook 138,954 lines 8,032 2026-11-03 adequate
kubevela/kubevela 3 adequate · 2 strong Go 547,074 lines 7,920 2026-11-03 adequate
bagisto/bagisto 2 adequate · 3 strong PHP 584,647 lines 28,271 2026-10-23 strong
hulaspark/hula 2 adequate · 2 strong Vue 168,421 lines 7,796 2026-11-03 adequate
concourse/concourse 3 adequate · 2 strong Go 481,544 lines 7,941 2026-11-03 adequate
hacs/integration 2 adequate · 2 strong Python 40,087 lines 7,869 2026-11-03 adequate
teableio/teable 3 adequate · 2 strong TypeScript 1,458,621 lines 21,849 2026-10-25 adequate
flyteorg/flyte 4 adequate · 1 strong Go 611,810 lines 7,845 2026-11-03 adequate
open-telemetry/opentelemetry-collector 4 strong Go 330,563 lines 7,728 2026-11-03 strong
powerjob/powerjob 2 adequate · 3 strong Java 61,702 lines 7,811 2026-11-03 strong
opentofu/opentofu 4 adequate · 1 strong Go 656,372 lines 30,575 2026-10-22 adequate
failproofai/failproofai 3 adequate · 2 strong TypeScript 472,881 lines 7,653 2026-11-03 adequate
thingsboard/thingsboard 2 adequate · 3 strong Java 1,431,442 lines 22,501 2026-10-25 adequate
deepset-ai/haystack 2 adequate · 2 strong Python 1,685,337 lines 26,818 2026-10-23 adequate
jarun/nnn 2 adequate · 2 strong C 19,713 lines 22,016 2026-10-25 adequate
netbirdio/netbird 2 adequate · 3 strong Go 711,266 lines 30,142 2026-10-22 adequate
gitleaks/gitleaks 2 adequate · 3 strong Go 27,496 lines 30,233 2026-10-22 strong
folke/lazy.nvim 1 adequate · 3 strong Lua 19,093 lines 21,602 2026-10-25 strong
humanlayer/12-factor-agents 3 adequate · 1 strong TypeScript 36,341 lines 26,849 2026-10-23 adequate
kubeedge/kubeedge 2 adequate · 3 strong Go 317,215 lines 7,621 2026-11-03 strong
labring/laf 3 adequate · 2 strong TypeScript 124,612 lines 7,547 2026-11-03 adequate
kubernetes-sigs/headlamp 3 adequate · 2 strong TypeScript 422,437 lines 7,553 2026-11-03 adequate
docmost/docmost 3 adequate · 2 strong TypeScript 172,685 lines 21,830 2026-10-25 adequate
refly-ai/refly 4 adequate · 1 strong TypeScript 390,787 lines 7,545 2026-11-03 adequate
matomo-org/matomo 4 strong PHP 1,236,978 lines 21,899 2026-10-25 strong
evcc-io/evcc 2 adequate · 3 strong Go 445,388 lines 7,506 2026-11-03 strong
gitbutlerapp/gitbutler 1 adequate · 3 strong Rust 689,361 lines 21,750 2026-10-25 strong
projectcalico/calico 4 adequate · 1 strong Go 1,178,755 lines 7,411 2026-11-03 adequate
persepolisdm/persepolis 3 adequate · 1 strong Python 23,366 lines 7,489 2026-11-03 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.