The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
orange-cyberdefense/goad 2 adequate · 1 strong PowerShell 60,380 lines 8,529 2026-10-23 adequate
cloudboost/cloudboost 2 adequate · 3 strong JavaScript 265,457 lines 1,460 2026-11-08 adequate
processone/ejabberd 1 adequate · 3 strong Erlang 179,463 lines 6,734 2026-10-25 strong
getsentry/self-hosted 5 adequate Shell 9,230 lines 9,621 2026-10-22 adequate
jooq/jooq 2 adequate · 2 strong Java 770,578 lines 6,793 2026-10-25 adequate
marmelab/atomic-crm 3 adequate · 2 strong TypeScript 78,583 lines 1,432 2026-11-08 adequate
elementary-data/elementary 1 adequate · 3 strong HTML 65,126 lines 2,429 2026-11-03 strong
primocms/primo 3 adequate · 2 strong Svelte 68,308 lines 2,380 2026-11-03 adequate
measure-sh/measure 2 adequate · 3 strong TypeScript 642,158 lines 1,427 2026-11-08 strong
falcosecurity/falco 4 adequate · 1 strong C++ 59,618 lines 9,510 2026-10-22 adequate
awesomewm/awesome 2 adequate · 2 strong Lua 152,314 lines 6,967 2026-10-25 adequate
datavane/tis 5 adequate Java 375,795 lines 1,440 2026-11-07 adequate
tinyauthapp/tinyauth 3 adequate · 2 strong Go 34,660 lines 8,412 2026-10-23 adequate
ovh/utask 2 adequate · 3 strong Go 42,874 lines 1,413 2026-11-08 strong
crev-dev/cargo-crev 4 strong Rust 21,153 lines 2,342 2026-11-03 strong
opendatadiscovery/odd-platform 1 adequate · 3 strong Java 205,132 lines 1,441 2026-11-07 strong
dgiot/dgiot 3 adequate Erlang 139,323 lines 4,861 2026-10-28 adequate
quarylabs/quary 2 adequate · 2 strong Rust 141,862 lines 2,386 2026-11-03 adequate
zeusln/zeus 2 adequate · 2 strong TypeScript 500,039 lines 1,404 2026-11-08 adequate
juspay/hyperswitch-prism 3 adequate · 2 strong Rust 1,164,868 lines 1,392 2026-11-08 adequate
ocaml/opam 1 adequate · 2 strong OCaml 99,697 lines 1,382 2026-11-08 adequate
formio/formio 2 adequate · 3 strong JavaScript 119,932 lines 2,328 2026-11-03 strong
lightningnetwork/lnd 2 adequate · 3 strong Go 914,706 lines 8,204 2026-10-23 strong
librephotos/librephotos 3 adequate · 2 strong Python 525,737 lines 8,112 2026-10-23 adequate
fkie-cad/cwe_checker 1 adequate · 2 strong Rust 59,414 lines 1,364 2026-11-08 adequate
timeplus-io/proton 3 adequate · 2 strong C++ 2,133,893 lines 2,281 2026-11-03 adequate
hystax/optscale 3 adequate · 2 strong Python 460,833 lines 2,238 2026-11-03 adequate
turbot/steampipe 5 adequate Go 65,198 lines 7,989 2026-10-23 adequate
pump-io/pump.io 2 adequate · 3 strong JavaScript 118,278 lines 2,240 2026-11-03 adequate
warrant-dev/warrant 3 adequate · 1 strong Go 44,969 lines 1,341 2026-11-08 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.