The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
nocobase/nocobase 2 adequate · 3 strong TypeScript 2,226,632 lines 24,682 2026-10-23 strong
infobyte/faraday 3 adequate · 2 strong Python 90,000 lines 6,838 2026-11-03 adequate
hashicorp/vagrant 3 strong Ruby 165,793 lines 27,216 2026-10-22 adequate
simplex-chat/simplex-chat 4 adequate · 1 strong Haskell 454,035 lines 19,504 2026-10-25 adequate
typesense/typesense 2 adequate · 3 strong C++ 289,731 lines 27,026 2026-10-22 strong
postgresml/postgresml 4 adequate · 1 strong Rust 96,274 lines 6,826 2026-11-03 adequate
requestly/requestly 2 strong — 1,329 lines 6,760 2026-11-03 adequate
ppy/osu 4 strong C# 611,156 lines 19,197 2026-10-25 strong
neutrinolabs/xrdp 1 adequate · 2 strong C 207,190 lines 6,778 2026-11-03 adequate
humhub/humhub 1 adequate · 3 strong PHP 397,214 lines 6,775 2026-11-03 strong
bookstackapp/bookstack 2 adequate · 3 strong PHP 285,160 lines 19,056 2026-10-25 strong
opencost/opencost 2 adequate · 3 strong Go 262,294 lines 6,801 2026-11-03 strong
mai-with-u/maibot 2 adequate · 3 strong Python 588,507 lines 6,833 2026-11-03 strong
flarum/framework 4 strong PHP 343,413 lines 6,767 2026-11-03 strong
openshot/openshot-qt 3 strong Python 166,622 lines 6,739 2026-11-03 adequate
krayin/laravel-crm 2 adequate · 2 strong PHP 160,166 lines 24,049 2026-10-23 adequate
node-red/node-red 2 adequate · 2 strong JavaScript 66,908 lines 23,775 2026-10-23 adequate
data-centric-ai-community/fg-data-profiling 4 strong Python 29,057 lines 13,744 2026-10-28 strong
osquery/osquery 4 strong C++ 439,256 lines 23,669 2026-10-23 strong
rivet-dev/rivet 2 adequate · 2 strong Rust 494,930 lines 6,564 2026-11-03 adequate
koharu-rs/koharu 2 adequate · 2 strong Rust 180,296 lines 6,578 2026-11-03 adequate
jetlinks/jetlinks-community 5 adequate Java 158,221 lines 6,675 2026-11-03 adequate
bruin-data/ingestr 2 adequate · 3 strong Go 480,986 lines 4,031 2026-11-07 adequate
spinframework/spin 3 adequate · 2 strong Rust 104,905 lines 6,565 2026-11-03 adequate
docusealco/docuseal 3 adequate · 2 strong Ruby 127,325 lines 18,639 2026-10-25 adequate
pixie-io/pixie 3 adequate · 2 strong C++ 881,907 lines 6,552 2026-11-03 adequate
rancher/rancher 3 adequate · 2 strong Go 735,297 lines 25,997 2026-10-22 adequate
goauthentik/authentik 2 adequate · 3 strong Python 661,040 lines 26,050 2026-10-22 strong
oomol-lab/pdf-craft 2 adequate · 2 strong Python 117,364 lines 6,481 2026-11-03 adequate
jaegertracing/jaeger 2 adequate · 3 strong Go 293,274 lines 23,332 2026-10-23 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.