The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
pinpoint-apm/pinpoint 1 adequate · 3 strong Java 848,765 lines 13,870 2026-10-23 strong
tracecathq/tracecat 4 adequate · 1 strong Python 1,333,224 lines 3,887 2026-11-03 adequate
cilium/pwru 5 adequate C 112,818 lines 3,847 2026-11-03 adequate
supertokens/supertokens-core 2 adequate · 2 strong Java 255,454 lines 15,333 2026-10-22 adequate
1backend/1backend 3 adequate · 2 strong Go 284,568 lines 2,355 2026-11-07 adequate
ruby-china/homeland 2 adequate · 3 strong Ruby 26,563 lines 3,859 2026-11-03 strong
domoticz/domoticz 2 adequate · 3 strong C++ 481,546 lines 3,829 2026-11-03 strong
fluent/fluentd 4 strong Ruby 124,651 lines 13,611 2026-10-23 strong
puckeditor/puck 1 adequate · 3 strong TypeScript 49,192 lines 13,515 2026-10-23 strong
searx/searx 4 adequate · 1 strong Python 42,397 lines 13,558 2026-10-23 adequate
trykimu/videoeditor 3 adequate · 2 strong TypeScript 26,693 lines 2,285 2026-11-08 adequate
instill-ai/instill-core 3 adequate · 2 strong Python 64,120 lines 2,320 2026-11-07 adequate
tinode/chat 2 adequate · 3 strong Go 79,424 lines 13,530 2026-10-23 strong
ory/polis 1 adequate · 4 strong TypeScript 53,510 lines 2,269 2026-11-08 strong
scipag/vulscan 2 adequate Lua 2,178 lines 3,793 2026-11-03 adequate
sqlite/sqlite 1 adequate · 2 strong C 550,555 lines 10,540 2026-10-25 adequate
trinodb/trino 2 adequate · 3 strong Java 1,892,827 lines 13,364 2026-10-23 strong
gogf/gf 2 adequate · 2 strong Go 609,547 lines 13,287 2026-10-23 adequate
serde-rs/serde 1 adequate · 2 strong Rust 43,784 lines 10,831 2026-10-25 adequate
cocoalumberjack/cocoalumberjack 3 strong Objective-C 44,885 lines 13,318 2026-10-23 adequate
portkey-ai/gateway 4 adequate · 1 strong TypeScript 107,020 lines 13,259 2026-10-23 adequate
tstack/lnav 3 adequate · 2 strong C++ 480,460 lines 10,716 2026-10-25 adequate
polyaxon/polyaxon 3 adequate MDX 3,131 lines 3,748 2026-11-03 adequate
langchain4j/langchain4j 4 strong Java 687,385 lines 13,288 2026-10-23 strong
debezium/debezium 2 adequate · 2 strong Java 642,270 lines 13,266 2026-10-23 adequate
webhintio/hint 1 adequate · 3 strong TypeScript 177,194 lines 3,701 2026-11-03 strong
akuity/kargo 5 adequate Go 563,773 lines 3,754 2026-11-03 adequate
logto-io/logto 3 adequate · 2 strong TypeScript 639,179 lines 14,750 2026-10-22 adequate
builderio/figma-html 1 adequate · 2 strong TypeScript 954 lines 3,713 2026-11-03 adequate
neuml/txtai 1 adequate · 3 strong Python 63,035 lines 13,029 2026-10-23 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.