The library
Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.
| Repository | Language | Size | Stars | Read | Band |
|---|---|---|---|---|---|
| sync-in/server 3 adequate · 2 strong | TypeScript | 144,642 lines | 1,951 | 2026-11-03 | |
| dolibarr/dolibarr 2 adequate · 3 strong | PHP | 1,516,686 lines | 7,761 | 2026-10-22 | |
| scality/cloudserver 2 adequate · 3 strong | JavaScript | 206,787 lines | 1,954 | 2026-11-03 | |
| kanidm/kanidm 3 adequate · 2 strong | Rust | 448,893 lines | 5,431 | 2026-10-25 | |
| luraproject/lura 1 adequate · 4 strong | Go | 23,265 lines | 6,805 | 2026-10-23 | |
| macpass/macpass 3 adequate · 1 strong | Objective-C | 32,107 lines | 6,885 | 2026-10-23 | |
| bugbakery/audapolis 1 adequate · 4 strong | TypeScript | 16,774 lines | 1,905 | 2026-11-03 | |
| grpc-ecosystem/go-grpc-middleware 4 strong | Go | 14,363 lines | 6,759 | 2026-10-23 | |
| kptdev/kpt 1 adequate · 4 strong | Go | 125,440 lines | 1,900 | 2026-11-03 | |
| greptimeteam/greptimedb 3 adequate · 2 strong | Rust | 1,165,036 lines | 6,760 | 2026-10-23 | |
| tanstack/form 4 strong | TypeScript | 123,755 lines | 6,742 | 2026-10-23 | |
| unkeyed/unkey 2 adequate · 3 strong | Go | 743,381 lines | 5,455 | 2026-10-25 | |
| tautulli/tautulli 2 adequate · 3 strong | Python | 639,556 lines | 6,618 | 2026-10-23 | |
| django-oscar/django-oscar 4 strong | Python | 94,057 lines | 6,627 | 2026-10-23 | |
| cloudquery/cloudquery 1 adequate · 4 strong | Go | 163,747 lines | 6,544 | 2026-10-23 | |
| decidim/decidim 1 adequate · 4 strong | Ruby | 907,688 lines | 1,846 | 2026-11-03 | |
| codeberg.org/readeck/readeck 2 adequate · 3 strong | Go | 179,340 lines | 1,191 | 2026-11-07 | |
| roxy-wi/roxy-wi 2 adequate · 3 strong | Python | 178,738 lines | 1,833 | 2026-11-03 | |
| dbt-labs/metricflow 2 adequate · 3 strong | Python | 1,022,841 lines | 1,857 | 2026-11-03 | |
| apache/flink-cdc 3 adequate · 1 strong | Java | 462,721 lines | 6,485 | 2026-10-23 | |
| part-db/part-db-server 2 adequate · 3 strong | PHP | 204,138 lines | 1,826 | 2026-11-03 | |
| ossf/cve-bin-tool 2 adequate · 2 strong | Python | 94,069 lines | 1,808 | 2026-11-03 | |
| gitlab.com/gitlab-org/cli 2 adequate · 2 strong | — | 217,035 lines | 1,101 | 2026-11-08 | |
| apiparklab/apipark 4 adequate · 1 strong | TypeScript | 151,014 lines | 1,823 | 2026-11-03 | |
| umbraco/umbraco-cms 3 adequate · 2 strong | C# | 1,420,731 lines | 5,279 | 2026-10-25 | |
| sonicjs-org/sonicjs 3 adequate · 2 strong | TypeScript | 290,370 lines | 1,785 | 2026-11-03 | |
| dialmasterorg/youtarr 3 adequate · 2 strong | JavaScript | 320,103 lines | 1,792 | 2026-11-03 | |
| openchoreo/openchoreo 3 adequate · 2 strong | Go | 717,077 lines | 1,759 | 2026-11-03 | |
| rack/rack 1 adequate · 2 strong | Ruby | 25,462 lines | 5,132 | 2026-10-25 | |
| lynpoint/cyberverse 2 adequate · 2 strong | Python | 128,537 lines | 1,749 | 2026-11-03 |
What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.
How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.