The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
uptrace/uptrace 3 adequate · 2 strong Go 118,493 lines 4,306 2026-10-23 adequate
topiam/eiam 3 adequate · 2 strong Java 154,529 lines 1,219 2026-11-03 adequate
monica-pass/monica 2 adequate · 1 strong Kotlin 660,739 lines 1,206 2026-11-03 adequate
ocaml-ppx/ocamlformat 1 adequate · 2 strong OCaml 68,956 lines 733 2026-11-07 adequate
vercel/workflow 3 adequate · 2 strong TypeScript 515,794 lines 2,478 2026-10-28 adequate
sharetribe/sharetribe 3 adequate · 2 strong Ruby 412,940 lines 2,448 2026-10-28 adequate
codeberg.org/superseriousbusiness/gotosocial 3 adequate · 2 strong Go 396,660 lines 669 2026-11-08 adequate
flippercloud/flipper 3 adequate · 2 strong Ruby 45,795 lines 3,973 2026-10-23 adequate
bigcapitalhq/bigcapital 5 adequate TypeScript 454,295 lines 3,956 2026-10-23 adequate
gmwalletapp/epusdt 3 adequate · 2 strong Go 43,160 lines 3,920 2026-10-23 adequate
status-im/nimbus-eth2 4 adequate Nim 228,615 lines 663 2026-11-07 adequate
pimcore/pimcore 1 adequate · 3 strong PHP 331,211 lines 3,879 2026-10-23 adequate
lunarphp/lunar 1 adequate · 3 strong PHP 145,979 lines 3,763 2026-10-23 strong
e-m-b-a/emba 5 adequate Shell 79,358 lines 3,720 2026-10-23 adequate
scouter-project/scouter 2 adequate · 1 strong Java 271,886 lines 2,179 2026-10-28 adequate
owncloud/ocis 2 adequate · 3 strong Go 652,310 lines 2,171 2026-10-28 strong
xtdb/xtdb 3 adequate · 2 strong Clojure 212,676 lines 3,078 2026-10-25 adequate
heyputer/everything 3 adequate JavaScript 1,751,334 lines 3,709 2026-10-23 adequate
jitsi/docker-jitsi-meet 3 adequate · 1 strong Lua 13,416 lines 3,619 2026-10-23 adequate
slatedb/slatedb 2 adequate · 2 strong Rust 242,643 lines 3,582 2026-10-23 adequate
nextflow-io/nextflow 1 adequate · 3 strong Groovy 690,031 lines 3,516 2026-10-23 strong
espocrm/espocrm 2 adequate · 2 strong PHP 854,588 lines 3,513 2026-10-23 adequate
shopware/shopware 5 strong PHP 2,123,507 lines 3,454 2026-10-23 strong
terminusdb/terminusdb 2 adequate · 3 strong Prolog 182,550 lines 3,456 2026-10-23 strong
maplibre/maplibre-compose 1 adequate · 3 strong Kotlin 177,265 lines 585 2026-11-08 strong
gitlab.com/fdroid/fdroidclient 2 adequate · 2 strong — 131,151 lines 2,669 2026-10-25 adequate
aliasvault/aliasvault 4 adequate · 1 strong TypeScript 392,127 lines 3,307 2026-10-23 adequate
metabase/metabase 5 adequate Clojure 2,358,617 lines 49,430 2026-09-30 adequate
celery/kombu 4 strong Python 63,448 lines 3,151 2026-10-23 strong
gitlab.com/gitlab-org/gitlab-runner 2 adequate · 3 strong — 348,703 lines 2,570 2026-10-25 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.