The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
ether/etherpad 3 adequate · 2 strong TypeScript 182,891 lines 18,595 2026-10-23 adequate
defectdojo/django-defectdojo 2 adequate · 3 strong Python 1,413,006 lines 5,183 2026-11-03 strong
argilla-io/argilla 1 adequate · 4 strong Python 234,143 lines 5,193 2026-11-03 adequate
envoyproxy/gateway 1 adequate · 4 strong Go 1,439,869 lines 3,126 2026-11-08 strong
fable-compiler/fable 2 adequate · 2 strong F# 647,582 lines 3,153 2026-11-07 adequate
joomla/joomla-cms 2 adequate · 2 strong PHP 604,148 lines 5,165 2026-11-03 adequate
radarr/radarr 2 adequate · 3 strong C# 380,643 lines 14,451 2026-10-25 strong
grokability/snipe-it 2 adequate · 3 strong PHP 728,753 lines 14,978 2026-10-25 strong
asyncfuncai/deepwiki-open 4 adequate · 1 strong Python 28,146 lines 18,267 2026-10-23 adequate
ktorio/ktor 2 adequate · 2 strong Kotlin 328,012 lines 14,532 2026-10-25 adequate
nicotine-plus/nicotine-plus 1 adequate · 3 strong Python 72,425 lines 3,141 2026-11-07 strong
mediacms-io/mediacms 4 adequate · 1 strong Python 171,997 lines 5,177 2026-11-03 adequate
taubyte/tau 3 adequate · 1 strong Go 327,203 lines 5,183 2026-11-03 adequate
rowboatlabs/rowboat 3 adequate · 2 strong TypeScript 340,761 lines 18,059 2026-10-23 adequate
simolus3/drift 1 adequate · 2 strong Dart 272,388 lines 3,301 2026-11-07 adequate
inspec/inspec 1 adequate · 3 strong Ruby 166,855 lines 3,100 2026-11-08 strong
colanode/colanode 4 adequate · 1 strong TypeScript 92,407 lines 5,185 2026-11-03 adequate
sitespeedio/sitespeed.io 3 adequate · 2 strong JavaScript 95,335 lines 5,047 2026-11-03 adequate
arroyosystems/arroyo 3 adequate · 2 strong Rust 142,558 lines 5,077 2026-11-03 adequate
influxdata/telegraf 2 adequate · 3 strong Go 731,313 lines 17,880 2026-10-23 strong
ossec/ossec-hids 2 adequate · 3 strong C 255,581 lines 5,070 2026-11-03 strong
sweetalert2/sweetalert2 1 adequate · 3 strong JavaScript 15,921 lines 18,097 2026-10-23 strong
asciinema/asciinema 1 adequate · 2 strong Rust 11,754 lines 17,905 2026-10-23 adequate
lemmynet/lemmy 3 adequate · 2 strong Rust 134,751 lines 14,614 2026-10-25 adequate
healthchecks/healthchecks 3 adequate · 2 strong Python 72,641 lines 10,464 2026-10-28 adequate
nezhahq/nezha 3 adequate · 2 strong Go 120,080 lines 10,377 2026-10-28 adequate
victoriametrics/victoriametrics 1 adequate · 4 strong Go 509,859 lines 17,898 2026-10-23 strong
oceanbase/oceanbase 2 adequate · 2 strong C++ 2,133,075 lines 10,357 2026-10-28 adequate
final-form/final-form 1 adequate · 3 strong TypeScript 14,932 lines 3,048 2026-11-07 strong
dtyq/magic 4 adequate · 1 strong TypeScript 2,432,747 lines 5,063 2026-11-03 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.