The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
liftbridge-io/liftbridge 3 adequate · 2 strong Go 77,374 lines 2,805 2026-10-28 adequate
deuxfleurs-org/garage 2 adequate · 2 strong Rust 98,226 lines 4,756 2026-10-23 adequate
openziti/zrok 3 adequate · 2 strong Go 303,988 lines 4,783 2026-10-23 adequate
home-assistant/android 2 adequate · 2 strong Kotlin 215,300 lines 3,923 2026-10-25 adequate
jenkins-x/jx 2 adequate · 3 strong Go 7,014 lines 4,691 2026-10-23 strong
eclipsesource/jsonforms 2 adequate · 2 strong TypeScript 104,071 lines 2,752 2026-10-28 adequate
acinq/eclair 1 adequate · 4 strong Scala 169,740 lines 1,349 2026-11-03 strong
webonyx/graphql-php 3 strong PHP 102,983 lines 4,711 2026-10-23 adequate
gitlab.com/cryptsetup/cryptsetup 4 strong — 100,666 lines 851 2026-11-07 strong
ergo-services/ergo 2 adequate · 1 strong Go 132,016 lines 4,682 2026-10-23 adequate
cerbos/cerbos 3 adequate · 2 strong Go 345,006 lines 4,631 2026-10-23 adequate
enterpilot/gomodel 2 adequate · 3 strong Go 550,673 lines 1,298 2026-11-03 strong
gitlab.com/commento/commento 2 adequate · 2 strong — 14,894 lines 779 2026-11-08 adequate
build-trust/ockam 3 strong Rust 245,908 lines 4,639 2026-10-23 adequate
dtstack/taier 4 adequate · 1 strong Java 390,484 lines 1,287 2026-11-03 adequate
emissary-ingress/emissary 2 adequate · 3 strong Python 201,565 lines 4,521 2026-10-23 strong
elastic/apm-server 5 strong Go 114,220 lines 1,271 2026-11-03 strong
vernemq/vernemq 2 adequate · 2 strong Erlang 91,911 lines 3,637 2026-10-25 adequate
longguikeji/arkid 4 adequate · 1 strong Python 89,054 lines 1,285 2026-11-03 adequate
freeplane/freeplane 2 adequate · 2 strong Java 477,713 lines 4,433 2026-10-23 adequate
rudderlabs/rudder-server 3 adequate · 2 strong Go 406,513 lines 4,505 2026-10-23 adequate
cert-polska/artemis 3 adequate · 2 strong Python 58,252 lines 1,254 2026-11-03 adequate
dagucloud/dagu 4 adequate · 1 strong Go 995,418 lines 4,428 2026-10-23 adequate
tduckcloud/tduck-survey-form 3 adequate · 1 strong Java 29,559 lines 1,258 2026-11-03 adequate
archtechx/tenancy 2 adequate · 3 strong PHP 34,010 lines 4,425 2026-10-23 strong
smallstep/cli 3 adequate · 2 strong Go 46,801 lines 4,355 2026-10-23 adequate
deepflowio/deepflow 3 adequate · 2 strong Go 547,342 lines 4,305 2026-10-23 adequate
swetrix/swetrix 4 adequate · 1 strong TypeScript 328,922 lines 1,211 2026-11-03 adequate
uptrace/uptrace 3 adequate · 2 strong Go 118,493 lines 4,306 2026-10-23 adequate
topiam/eiam 3 adequate · 2 strong Java 154,529 lines 1,219 2026-11-03 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.