The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
harnessmd/munder-difflin 2 adequate · 2 strong TypeScript 378,405 lines 9,149 2026-10-28 adequate
gojue/ecapture 3 adequate · 2 strong C 72,767 lines 15,516 2026-10-23 adequate
crate/crate 4 strong Java 858,205 lines 4,450 2026-11-03 strong
crunchydata/postgres-operator 2 adequate · 3 strong Go 124,157 lines 4,456 2026-11-03 strong
questdb/questdb 3 adequate · 2 strong Java 1,880,873 lines 17,462 2026-10-22 adequate
cilium/hubble 1 adequate · 3 strong Makefile 21,926 lines 4,376 2026-11-03 strong
dependencytrack/dependency-track 1 adequate · 4 strong Java 412,000 lines 4,401 2026-11-03 strong
greaterwms/greaterwms 3 adequate · 2 strong Python 77,175 lines 4,429 2026-11-03 adequate
heyform/heyform 2 adequate · 3 strong TypeScript 129,387 lines 9,055 2026-10-28 strong
jitsi/jitsi 2 adequate · 1 strong Java 625,918 lines 4,354 2026-11-03 adequate
openflagr/flagr 2 adequate · 3 strong Go 70,879 lines 2,611 2026-11-08 strong
etar-group/etar-calendar 1 adequate · 2 strong Java 78,151 lines 2,631 2026-11-07 adequate
frappe/hrms 4 adequate · 1 strong Python 156,033 lines 8,972 2026-10-28 adequate
semgrep/semgrep 1 adequate · 3 strong C 1,526,065 lines 17,186 2026-10-22 strong
laudspeaker/laudspeaker 3 adequate · 2 strong TypeScript 155,304 lines 2,629 2026-11-07 adequate
algorithmicsuperintelligence/optillm 2 adequate · 3 strong Python 57,794 lines 4,335 2026-11-03 strong
kludex/starlette 4 strong Python 28,883 lines 12,640 2026-10-25 strong
swanhubx/swanlab 4 strong Python 75,429 lines 4,350 2026-11-03 strong
theonedev/onedev 4 adequate · 1 strong Java 659,027 lines 15,328 2026-10-23 adequate
haiwen/seafile 2 adequate · 1 strong C 61,594 lines 15,371 2026-10-23 adequate
fisco-bcos/fisco-bcos 2 adequate · 2 strong C++ 333,949 lines 2,617 2026-11-07 adequate
structuredlabs/preswald 3 adequate · 2 strong Python 24,307 lines 4,270 2026-11-03 adequate
kubeflow/pipelines 4 adequate · 1 strong Python 949,184 lines 4,261 2026-11-03 adequate
altinity/clickhouse-operator 2 adequate · 3 strong Go 533,997 lines 2,578 2026-11-08 strong
oauth2-proxy/oauth2-proxy 2 adequate · 3 strong Go 105,439 lines 15,241 2026-10-23 strong
wal-g/wal-g 2 adequate · 3 strong Go 161,733 lines 4,326 2026-11-03 strong
ironcalc/ironcalc 3 adequate · 2 strong Rust 231,339 lines 4,246 2026-11-03 adequate
riemann/riemann 2 adequate · 2 strong Clojure 24,332 lines 4,269 2026-11-03 adequate
donutbrowser/donutbrowser 3 adequate · 2 strong Rust 422,900 lines 4,205 2026-11-03 adequate
plait-board/drawnix 3 adequate · 2 strong TypeScript 15,466 lines 14,974 2026-10-23 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.