The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
dialmasterorg/youtarr 3 adequate · 2 strong JavaScript 320,103 lines 1,792 2026-11-03 adequate
openchoreo/openchoreo 3 adequate · 2 strong Go 717,077 lines 1,759 2026-11-03 adequate
rack/rack 1 adequate · 2 strong Ruby 25,462 lines 5,132 2026-10-25 adequate
lynpoint/cyberverse 2 adequate · 2 strong Python 128,537 lines 1,749 2026-11-03 adequate
passbolt/passbolt_api 2 adequate · 3 strong PHP 481,336 lines 6,185 2026-10-23 strong
tracewayapp/traceway 3 adequate · 2 strong Go 344,922 lines 1,752 2026-11-03 adequate
flectar/mail 1 adequate · 3 strong Rust 320,029 lines 1,745 2026-11-03 strong
theopenco/llmgateway 4 adequate · 1 strong TypeScript 2,605,977 lines 1,723 2026-11-03 adequate
kimai/kimai 3 adequate · 2 strong PHP 195,110 lines 5,046 2026-10-25 adequate
spatie/laravel-backup 4 strong PHP 13,692 lines 6,026 2026-10-23 strong
easysoft/zentaopms 3 adequate · 2 strong PHP 1,726,170 lines 1,715 2026-11-03 adequate
lobsters/lobsters 2 adequate · 3 strong Ruby 31,848 lines 4,845 2026-10-25 strong
aklivity/zilla 3 adequate · 2 strong Java 1,247,467 lines 1,689 2026-11-03 adequate
streetcomplete/streetcomplete 2 adequate · 2 strong Kotlin 478,221 lines 4,931 2026-10-25 adequate
fluxml/flux.jl 1 adequate · 3 strong Julia 26,029 lines 4,751 2026-10-25 strong
commixproject/commix 2 adequate · 1 strong Python 90,039 lines 5,894 2026-10-23 adequate
babashka/babashka 4 adequate Clojure 105,871 lines 4,615 2026-10-25 adequate
killbill/killbill 1 adequate · 2 strong Java 299,381 lines 5,815 2026-10-23 adequate
dotenvx/dotenvx 3 adequate · 1 strong JavaScript 35,019 lines 5,848 2026-10-23 adequate
netlify/gocommerce 5 strong Go 12,329 lines 1,616 2026-11-03 adequate
kgateway-dev/kgateway 2 adequate · 3 strong Go 467,140 lines 5,723 2026-10-23 strong
sqlmesh/sqlmesh 2 adequate · 3 strong Python 338,931 lines 3,335 2026-10-28 strong
peerdb-io/peerdb 2 adequate · 3 strong Go 197,242 lines 3,310 2026-10-28 strong
mailtrain-org/mailtrain 3 adequate · 2 strong JavaScript 84,135 lines 5,757 2026-10-23 adequate
analogdotnow/analog 4 adequate · 1 strong TypeScript 101,904 lines 1,592 2026-11-03 adequate
devtron-labs/devtron 4 adequate · 1 strong Go 685,387 lines 5,621 2026-10-23 adequate
gitlab.com/famedly/conduit 3 adequate · 1 strong — 47,193 lines 963 2026-11-07 adequate
freescout-help-desk/freescout 3 adequate · 1 strong PHP 265,962 lines 4,582 2026-10-25 adequate
influxdata/chronograf 2 adequate · 3 strong TypeScript 254,649 lines 1,568 2026-11-03 strong
tirrenotechnologies/tirreno 3 strong PHP 151,213 lines 1,562 2026-11-03 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.