The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
shlinkio/shlink 1 adequate · 4 strong PHP 60,031 lines 5,401 2026-11-03 strong
vitessio/vitess 3 adequate · 2 strong Go 1,681,787 lines 21,390 2026-10-22 adequate
tribler/tribler 2 adequate · 3 strong Python 47,827 lines 5,343 2026-11-03 strong
worklenz/worklenz 3 adequate · 2 strong TypeScript 825,246 lines 3,280 2026-11-07 adequate
enterprisedb/barman 1 adequate · 3 strong Python 138,467 lines 3,272 2026-11-07 strong
dromara/sa-token 2 adequate · 2 strong Java 262,924 lines 19,098 2026-10-23 adequate
fail2ban/fail2ban 1 adequate · 2 strong Python 45,975 lines 18,855 2026-10-23 adequate
bluewave-labs/checkmate 2 adequate · 3 strong TypeScript 150,373 lines 11,029 2026-10-28 strong
duplicati/duplicati 3 adequate · 2 strong C# 376,332 lines 15,036 2026-10-25 adequate
deepfence/threatmapper 4 adequate · 1 strong TypeScript 334,276 lines 5,328 2026-11-03 adequate
zitadel/zitadel 4 adequate · 1 strong Go 1,141,569 lines 15,115 2026-10-25 adequate
plotly/plotly.py 1 adequate · 3 strong Python 591,790 lines 18,855 2026-10-23 strong
gravitational/teleport 3 adequate · 2 strong Go 2,308,336 lines 21,071 2026-10-22 adequate
cube-js/cube 1 adequate · 4 strong Rust 963,250 lines 21,061 2026-10-22 strong
documenso/documenso 3 adequate · 2 strong TypeScript 298,939 lines 15,191 2026-10-25 adequate
pointfreeco/swift-composable-architecture 2 adequate · 2 strong Swift 96,991 lines 14,942 2026-10-25 adequate
browser-use/browser-harness 1 adequate · 2 strong Python 53,530 lines 18,586 2026-10-23 adequate
fluvio-community/fluvio 1 adequate · 4 strong Rust 172,309 lines 5,259 2026-11-03 strong
teambit/bit 1 adequate · 3 strong TypeScript 356,642 lines 18,496 2026-10-23 strong
ether/etherpad 3 adequate · 2 strong TypeScript 182,891 lines 18,595 2026-10-23 adequate
defectdojo/django-defectdojo 2 adequate · 3 strong Python 1,413,006 lines 5,183 2026-11-03 strong
argilla-io/argilla 1 adequate · 4 strong Python 234,143 lines 5,193 2026-11-03 adequate
apijson/apijson 3 adequate · 1 strong Java 30,065 lines 18,389 2026-10-23 adequate
envoyproxy/gateway 1 adequate · 4 strong Go 1,439,869 lines 3,126 2026-11-08 strong
fable-compiler/fable 2 adequate · 2 strong F# 647,582 lines 3,153 2026-11-07 adequate
joomla/joomla-cms 2 adequate · 2 strong PHP 604,148 lines 5,165 2026-11-03 adequate
radarr/radarr 2 adequate · 3 strong C# 380,643 lines 14,451 2026-10-25 strong
grokability/snipe-it 2 adequate · 3 strong PHP 728,753 lines 14,978 2026-10-25 strong
asyncfuncai/deepwiki-open 4 adequate · 1 strong Python 28,146 lines 18,267 2026-10-23 adequate
ktorio/ktor 2 adequate · 2 strong Kotlin 328,012 lines 14,532 2026-10-25 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.