The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
celery/kombu 4 strong Python 63,448 lines 3,151 2026-10-23 strong
gitlab.com/gitlab-org/gitlab-runner 2 adequate · 3 strong — 348,703 lines 2,570 2026-10-25 strong
codeberg.org/grunfink/snac2 4 adequate · 1 strong C 36,941 lines 571 2026-11-07 adequate
tuiqiao/cboard 3 adequate · 1 strong JavaScript 275,270 lines 3,098 2026-10-23 adequate
pretix/pretix 3 adequate · 2 strong Python 454,829 lines 2,529 2026-10-25 adequate
codeberg.org/forgejo-contrib/forgejo-cli 2 adequate · 1 strong Rust 20,069 lines 557 2026-11-07 adequate
javamelody/javamelody 1 adequate · 2 strong Java 104,436 lines 3,043 2026-10-23 adequate
silexlabs/silex 3 adequate · 2 strong TypeScript 135,226 lines 3,016 2026-10-23 adequate
oauthlib/oauthlib 1 adequate · 3 strong Python 24,733 lines 2,988 2026-10-23 strong
zenstackhq/zenstack 4 strong TypeScript 218,120 lines 2,955 2026-10-23 strong
datalens-tech/datalens 2 adequate · 2 strong PLpgSQL 9,935 lines 1,708 2026-10-28 adequate
gitlab.com/auroraoss/aurorastore 3 adequate · 1 strong — 48,573 lines 2,262 2026-10-25 adequate
skyapm/skyapm-dotnet 4 adequate C# 24,699 lines 1,658 2026-10-28 adequate
1panel-dev/cordyscrm 4 adequate · 1 strong Java 414,120 lines 2,808 2026-10-23 adequate
jitsi/jitsi-meet-electron 1 adequate · 3 strong TypeScript 6,459 lines 1,635 2026-10-28 strong
codeberg.org/dnkl/foot 3 adequate · 1 strong C 63,483 lines 2,234 2026-10-25 adequate
alfio-event/alf.io 4 adequate · 1 strong Java 236,828 lines 1,626 2026-10-28 adequate
wpengine/faustjs 2 adequate · 3 strong TypeScript 41,260 lines 1,608 2026-10-28 strong
crbnos/carbon 4 adequate · 1 strong TypeScript 2,055,286 lines 2,756 2026-10-23 adequate
codeberg.org/mergiraf/mergiraf 3 adequate · 1 strong Rust 39,243 lines 456 2026-11-08 adequate
datazip-inc/olake 2 adequate · 3 strong Go 129,636 lines 1,571 2026-10-28 strong
fsprojects/paket 1 adequate · 3 strong F# 97,083 lines 2,086 2026-10-25 strong
tenancy/multi-tenant 1 adequate · 2 strong PHP 13,441 lines 2,601 2026-10-23 adequate
brightbeanxyz/brightbean-studio 3 adequate · 2 strong Python 160,211 lines 2,563 2026-10-23 adequate
pac4j/pac4j 1 adequate · 3 strong Java 117,467 lines 2,537 2026-10-23 strong
codeberg.org/simonrepp/faircamp 3 adequate · 1 strong Rust 81,786 lines 426 2026-11-08 adequate
suitenumerique/meet 4 adequate · 1 strong Python 149,669 lines 2,447 2026-10-23 adequate
codeberg.org/jannis/fitotrack 3 adequate · 1 strong Kotlin 44,303 lines 440 2026-11-07 adequate
getsentry/relay 2 adequate · 3 strong Rust 282,085 lines 401 2026-11-08 strong
victoriametrics/victorialogs 2 adequate · 3 strong Go 252,099 lines 2,399 2026-10-23 strong

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.