The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
riemann/riemann 2 adequate · 2 strong Clojure 24,332 lines 4,269 2026-11-03 adequate
donutbrowser/donutbrowser 3 adequate · 2 strong Rust 422,900 lines 4,205 2026-11-03 adequate
prowler-cloud/prowler 4 adequate · 1 strong Python 1,569,543 lines 15,090 2026-10-23 adequate
virgili0/virgilio 2 adequate · 1 strong Jupyter Notebook 14,589 lines 15,003 2026-10-23 adequate
elastic/logstash 2 adequate · 3 strong Java 227,604 lines 14,965 2026-10-23 strong
laravel/cashier-stripe 3 strong PHP 19,973 lines 2,548 2026-11-08 adequate
esm-dev/esm.sh 3 adequate · 2 strong Go 41,171 lines 4,187 2026-11-03 adequate
iterative/cml 1 adequate · 3 strong JavaScript 9,059 lines 4,190 2026-11-03 adequate
openrefine/openrefine 4 strong Java 274,244 lines 12,012 2026-10-25 strong
deeplethe/utopia 2 adequate · 3 strong Rust 366,732 lines 8,581 2026-10-28 strong
ucbepic/docetl 4 adequate · 1 strong Python 129,564 lines 4,191 2026-11-03 adequate
ankidroid/anki-android 1 adequate · 3 strong Kotlin 246,887 lines 11,889 2026-10-25 strong
tonejs/tone.js 1 adequate · 3 strong TypeScript 67,786 lines 14,787 2026-10-23 strong
esphome/esphome 2 adequate · 3 strong C++ 857,176 lines 11,722 2026-10-25 strong
yacy/yacy_search_server 4 adequate · 1 strong Java 366,209 lines 4,097 2026-11-03 adequate
squidex/squidex 3 adequate · 2 strong C# 502,089 lines 2,508 2026-11-07 adequate
bytebase/bytebase 3 adequate · 2 strong Go 1,396,358 lines 14,623 2026-10-23 adequate
casdoor/casdoor 4 adequate · 1 strong Go 292,198 lines 14,643 2026-10-23 adequate
juicedata/juicefs 3 adequate · 2 strong Go 229,965 lines 14,567 2026-10-23 adequate
dagster-io/dagster 3 adequate · 2 strong Python 36,142 lines 16,314 2026-10-22 adequate
com-lihaoyi/ammonite 1 adequate · 3 strong Scala 34,686 lines 2,628 2026-11-07 adequate
griddb/griddb 2 adequate · 3 strong C++ 988,535 lines 2,473 2026-11-07 strong
rotki/rotki 2 adequate · 3 strong Python 1,121,031 lines 4,073 2026-11-03 strong
rubygems/rubygems.org 3 adequate · 2 strong Ruby 114,212 lines 2,441 2026-11-08 adequate
qloapps/qloapps 3 adequate · 1 strong PHP 734,862 lines 14,445 2026-10-23 adequate
libvips/libvips 3 adequate · 1 strong C 286,565 lines 11,697 2026-10-25 adequate
kopia/kopia 1 adequate · 3 strong Go 173,900 lines 14,410 2026-10-23 strong
element-hq/element-x-android 4 strong Kotlin 408,128 lines 2,424 2026-11-08 strong
ravendb/ravendb 2 adequate · 3 strong C# 1,948,386 lines 4,014 2026-11-03 strong
jhy/jsoup 3 strong Java 66,660 lines 11,402 2026-10-25 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.