The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
rustls/rustls 1 adequate · 2 strong Rust 88,522 lines 7,647 2026-10-25 adequate
supabase/realtime 2 adequate · 3 strong Elixir 116,133 lines 7,644 2026-10-25 strong
checkmarx/kics 3 adequate · 2 strong Open Policy Agent 976,910 lines 2,730 2026-11-03 adequate
kaelio/ktx 4 adequate · 1 strong TypeScript 344,283 lines 1,628 2026-11-08 adequate
xonsh/xonsh 4 strong Python 130,236 lines 9,685 2026-10-23 strong
krakend/krakend-ce 2 adequate · 3 strong Go 5,635 lines 2,702 2026-11-03 strong
attify/firmware-analysis-toolkit 1 adequate · 2 strong Rust 249,207 lines 1,622 2026-11-08 adequate
higress-group/higress 3 adequate · 2 strong Go 553,319 lines 9,630 2026-10-23 adequate
goplus/xgo 1 adequate · 3 strong Go 89,812 lines 9,487 2026-10-23 strong
gridaco/grida 2 adequate · 2 strong TypeScript 1,065,038 lines 2,696 2026-11-03 adequate
fthomas/refined 1 adequate · 2 strong Scala 14,267 lines 1,731 2026-11-07 adequate
open-web-analytics/open-web-analytics 4 strong PHP 219,212 lines 2,697 2026-11-03 strong
yugabyte/yugabyte-db 3 adequate · 2 strong C 2,421,340 lines 10,617 2026-10-22 adequate
readyouapp/readyou 3 adequate · 1 strong Kotlin 48,474 lines 7,559 2026-10-25 adequate
snyk/driftctl 2 adequate · 2 strong Go 275,993 lines 2,666 2026-11-03 adequate
risingwavelabs/risingwave 3 adequate · 2 strong Rust 1,196,119 lines 9,399 2026-10-23 adequate
linuxserver/heimdall 1 adequate · 4 strong PHP 61,924 lines 9,365 2026-10-23 strong
absmach/magistrala 2 adequate · 3 strong Go 119,482 lines 2,658 2026-11-03 strong
duendesoftware/products 2 adequate · 3 strong C# 520,009 lines 1,613 2026-11-07 strong
activeloopai/deeplake 2 adequate · 2 strong C++ 252,241 lines 9,258 2026-10-23 adequate
open-pencil/open-pencil 3 adequate · 2 strong TypeScript 684,273 lines 9,218 2026-10-23 adequate
bitnami/sealed-secrets 2 adequate · 3 strong Go 25,226 lines 9,316 2026-10-23 strong
gridstack/gridstack.js 1 adequate · 3 strong TypeScript 57,325 lines 9,208 2026-10-23 strong
nhost/nhost 3 adequate · 2 strong TypeScript 977,425 lines 9,365 2026-10-23 adequate
prestashop/prestashop 1 adequate · 4 strong PHP 1,368,776 lines 9,234 2026-10-23 strong
bigbluebutton/bigbluebutton 4 adequate · 1 strong TypeScript 445,094 lines 9,250 2026-10-23 adequate
dicioteam/dicio-android 2 adequate · 2 strong Kotlin 25,723 lines 1,536 2026-11-08 adequate
gitcoffee-os/postbot 2 adequate · 1 strong TypeScript 20,671 lines 1,568 2026-11-07 adequate
peergos/peergos 2 adequate · 1 strong Java 201,099 lines 2,548 2026-11-03 adequate
jolibrain/deepdetect 3 adequate · 1 strong C++ 150,976 lines 2,551 2026-11-03 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.