The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
hashicorp/nomad 2 adequate · 3 strong Go 855,891 lines 16,986 2026-10-25 strong
xmonad/xmonad 2 strong Haskell 9,227 lines 3,601 2026-11-07 adequate
cortexproject/cortex 2 adequate · 3 strong Go 417,512 lines 5,877 2026-11-03 strong
chaskiq/chaskiq 3 adequate · 2 strong TypeScript 164,980 lines 3,576 2026-11-08 adequate
tigerbeetle/tigerbeetle 1 adequate · 3 strong Zig 231,798 lines 17,090 2026-10-25 strong
qax-os/excelize 1 adequate · 3 strong Go 92,390 lines 21,016 2026-10-23 strong
janusgraph/janusgraph 1 adequate · 4 strong Java 272,715 lines 5,863 2026-11-03 strong
gofr-dev/gofr 1 adequate · 4 strong Go 273,089 lines 20,841 2026-10-23 strong
neondatabase/neon 2 adequate · 3 strong Rust 457,599 lines 23,246 2026-10-22 strong
arize-ai/phoenix 3 adequate · 2 strong Python 1,468,800 lines 12,041 2026-10-28 adequate
easegress-io/easegress 2 adequate · 3 strong Go 137,875 lines 5,873 2026-11-03 strong
agentgateway/agentgateway 2 adequate · 3 strong Rust 592,107 lines 5,907 2026-11-03 strong
lwouis/alt-tab-macos 2 adequate · 2 strong Swift 76,223 lines 16,353 2026-10-25 adequate
apache/shardingsphere 3 adequate · 2 strong Java 1,266,705 lines 20,813 2026-10-23 adequate
freshrss/freshrss 4 adequate · 1 strong PHP 151,993 lines 16,158 2026-10-25 adequate
vantage-sh/ec2instances.info 3 adequate · 1 strong TypeScript 46,606 lines 5,776 2026-11-03 adequate
pyspur-dev/pyspur 4 adequate · 1 strong TypeScript 70,510 lines 5,798 2026-11-03 adequate
home-assistant/frontend 1 adequate · 3 strong TypeScript 719,574 lines 5,779 2026-11-03 strong
bluenviron/mediamtx 2 adequate · 3 strong Go 111,343 lines 20,495 2026-10-23 strong
triggerdotdev/trigger.dev 4 adequate · 1 strong TypeScript 1,140,244 lines 16,444 2026-10-25 adequate
go-task/task 4 strong Go 63,386 lines 16,196 2026-10-25 strong
didi/dokit 2 adequate · 2 strong Java 255,854 lines 20,413 2026-10-23 adequate
hammerspoon/hammerspoon 2 adequate · 2 strong Objective-C 344,735 lines 16,199 2026-10-25 adequate
emqx/emqx 2 adequate · 3 strong Erlang 927,180 lines 16,763 2026-10-25 strong
partykit/partykit 1 adequate · 3 strong TypeScript 50,023 lines 5,744 2026-11-03 strong
bettercap/bettercap 4 adequate · 1 strong Go 112,414 lines 20,181 2026-10-23 adequate
apache/casbin 1 adequate · 3 strong Go 80,755 lines 20,467 2026-10-23 strong
gotify/server 2 adequate · 3 strong Go 29,734 lines 15,991 2026-10-25 strong
superstreamlabs/memphis 1 adequate · 4 strong Go 356,809 lines 3,444 2026-11-08 strong
mikefarah/yq 1 adequate · 3 strong Go 66,439 lines 16,017 2026-10-25 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.