The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
refly-ai/refly 4 adequate · 1 strong TypeScript 390,787 lines 7,545 2026-11-03 adequate
matomo-org/matomo 4 strong PHP 1,236,978 lines 21,899 2026-10-25 strong
evcc-io/evcc 2 adequate · 3 strong Go 445,388 lines 7,506 2026-11-03 strong
gitbutlerapp/gitbutler 1 adequate · 3 strong Rust 689,361 lines 21,750 2026-10-25 strong
projectcalico/calico 4 adequate · 1 strong Go 1,178,755 lines 7,411 2026-11-03 adequate
persepolisdm/persepolis 3 adequate · 1 strong Python 23,366 lines 7,489 2026-11-03 adequate
traceloop/openllmetry 2 adequate · 2 strong Python 376,531 lines 7,518 2026-11-03 adequate
p0deje/maccy 3 adequate · 1 strong Swift 11,116 lines 21,766 2026-10-25 adequate
mattermost-community/focalboard 3 adequate · 2 strong TypeScript 157,043 lines 26,522 2026-10-23 adequate
chroma-core/chroma 2 adequate · 3 strong Rust 519,579 lines 29,554 2026-10-22 strong
promptfoo/promptfoo 4 adequate · 1 strong TypeScript 1,407,640 lines 26,341 2026-10-23 adequate
nats-io/nats-server 2 adequate · 3 strong Go 475,473 lines 20,797 2026-10-25 strong
openfaas/faas 3 adequate · 2 strong Go 13,589 lines 26,253 2026-10-23 adequate
fabiolb/fabio 1 adequate · 4 strong Go 31,745 lines 7,346 2026-11-03 strong
scala-js/scala-js 1 adequate · 3 strong Scala 320,692 lines 4,707 2026-11-07 strong
postmanlabs/newman 2 adequate · 3 strong JavaScript 20,998 lines 7,273 2026-11-03 strong
sveltejs/kit 1 adequate · 4 strong JavaScript 143,426 lines 20,831 2026-10-25 strong
grafana/loki 3 adequate · 2 strong Go 1,196,883 lines 29,048 2026-10-22 adequate
civitai/civitai 2 adequate · 3 strong TypeScript 1,957,563 lines 7,306 2026-11-03 strong
browserbase/stagehand 1 adequate · 4 strong TypeScript 312,611 lines 25,793 2026-10-23 strong
gopasspw/gopass 2 adequate · 3 strong Go 109,465 lines 7,307 2026-11-03 strong
openpanel-dev/openpanel 3 adequate · 2 strong TypeScript 378,281 lines 7,243 2026-11-03 adequate
trufflesecurity/trufflehog 2 adequate · 3 strong Go 525,605 lines 28,647 2026-10-22 strong
mongodb/mongo 2 adequate · 2 strong C++ 2,103,542 lines 28,660 2026-10-22 adequate
nsqio/nsq 3 adequate · 2 strong Go 26,831 lines 25,771 2026-10-23 adequate
streetwriters/notesnook 3 adequate · 1 strong TypeScript 300,203 lines 14,845 2026-10-28 adequate
opensignlabs/opensign 5 adequate JavaScript 92,324 lines 7,215 2026-11-03 adequate
cilium/cilium 3 adequate · 2 strong Go 1,479,547 lines 25,711 2026-10-23 adequate
wagtail/wagtail 2 adequate · 3 strong Python 419,102 lines 20,507 2026-10-25 strong
open-multi-agent/open-multi-agent 4 strong TypeScript 154,895 lines 7,044 2026-11-03 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.