The library

Every public repository surveyed, browsable and searchable. Including the unflattering ones — a tool that only published good results would be a badge vending machine, not a diligence instrument.

All bands Strong Adequate 1,656 surveyed
Sort Relevance Newest Stars Lines of code Files History Findings Worst band
RepositoryLanguageSizeStarsReadBand
getsentry/relay 2 adequate · 3 strong Rust 282,085 lines 401 2026-11-08 strong
victoriametrics/victorialogs 2 adequate · 3 strong Go 252,099 lines 2,399 2026-10-23 strong
meltano/meltano 1 adequate · 3 strong Python 146,467 lines 2,667 2026-10-22 strong
talivia-group/talivia 2 adequate · 2 strong TypeScript 106,240 lines 2,372 2026-10-23 adequate
kubernetes-sigs/aws-iam-authenticator 2 adequate · 3 strong Go 19,135 lines 2,338 2026-10-23 strong
smallbets/userbase 3 adequate · 2 strong JavaScript 54,426 lines 2,337 2026-10-23 adequate
betterleaks/betterleaks 2 adequate · 3 strong Go 101,331 lines 2,322 2026-10-23 strong
spiculedata/saiku 3 adequate · 2 strong Java 490,055 lines 1,334 2026-10-28 adequate
pay-rails/pay 4 strong Ruby 87,300 lines 2,263 2026-10-23 strong
moonshine-software/moonshine 3 adequate · 1 strong PHP 95,134 lines 1,305 2026-10-28 adequate
os-autoinst/openqa 4 adequate · 1 strong Perl 290,050 lines 373 2026-11-08 adequate
mongodb/kingfisher 1 adequate · 3 strong Rust 279,321 lines 1,275 2026-10-28 strong
mettle/sendportal 2 adequate · 1 strong PHP 8,652 lines 2,180 2026-10-23 adequate
artifact-keeper/artifact-keeper 4 adequate · 1 strong Rust 1,024,594 lines 1,208 2026-10-28 adequate
gitguardian/ggshield 1 adequate · 3 strong Python 117,171 lines 2,009 2026-10-23 strong
dromara/maxkey 4 adequate · 1 strong Java 220,697 lines 1,977 2026-10-23 adequate
tsingyuai/growth-lab 1 adequate · 2 strong Python 9,936 lines 1,971 2026-10-23 adequate
featbit/featbit 3 adequate · 2 strong C# 314,467 lines 1,946 2026-10-23 adequate
getkirby/kirby 1 adequate · 3 strong PHP 382,331 lines 1,535 2026-10-25 strong
ever-co/ever-demand 3 adequate · 2 strong TypeScript 198,163 lines 1,868 2026-10-23 adequate
uselotus/lotus 3 adequate · 2 strong Python 130,173 lines 1,841 2026-10-23 adequate
always-open/laravel-totem 2 adequate · 3 strong PHP 17,071 lines 1,813 2026-10-23 strong
gitlab.com/graphviz/graphviz 4 strong — 244,282 lines 1,473 2026-10-25 strong
relaticle/relaticle 1 adequate · 4 strong PHP 457,689 lines 1,777 2026-10-23 adequate
koordinator-sh/koordinator 4 adequate · 1 strong Go 479,419 lines 1,765 2026-10-23 adequate
nim-lang/nimble 3 adequate Nim 65,801 lines 1,404 2026-10-25 adequate
django-helpdesk/django-helpdesk 2 adequate · 3 strong Python 40,714 lines 1,692 2026-10-23 strong
multiwoven/multiwoven 3 adequate · 2 strong Ruby 84,771 lines 1,683 2026-10-23 adequate
openshiporg/openship 3 adequate · 1 strong TypeScript 88,200 lines 1,654 2026-10-23 adequate
frigadehq/trench 4 adequate · 1 strong TypeScript 6,113 lines 1,665 2026-10-23 adequate

What a band means. A band sums up one reading of one commit: strong, adequate or significant findings. Here it counts the project's code, process, product, security and operations. A report reads more than that, so its band can differ from its row.

How listing works. Every public repository surveyed is listed — assessing public work is commentary on public work, and a library that hid the small ones would be quietly editorialising about which code counts. Private repositories are never listed. Anyone who proves control of a repo can attach a response to a finding, request a re-run, or delist it. Delisting is immediate and no-questions. An owner's response is removed only when it is unlawful, impersonates someone, publishes personal data or a credential, or is not about the finding. Disagreeing with the report is never a reason. To report a response, or to reach us about one, write to takedown@borehole.dev. There is no org-level score. Repositories are listed one by one, and sorting by band orders them by their own readings. Takedown: one email, 48 hours.