Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,673
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,643 recordsRanked by popularity · browse by tag · record statistics
NuGet
32At riskhealth index
DevTeam/Pure.DI
Pure DI for .NET
C#★ 823Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
RubyGems
29Criticalhealth index
spohlenz/tinymce-rails
Integration of TinyMCE with the Rails asset pipeline
JavaScript★ 823Jul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
—
29Criticalhealth index
alosaur/alosaur
Alosaur - Deno web framework with many ES Decorators
TypeScript★ 817Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
41At riskhealth index
JBZoo/Utils
Collection of useful PHP functions, mini-classes, and snippets for every day.
PHP★ 815↓ 10.5K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
35At riskhealth index
defstudio/telegraph
Telegraph is a Laravel package for fluently interacting with Telegram Bots
PHP★ 815↓ 15.2K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
crates.io
24Criticalhealth index
overdrivenpotato/rust-psp
Rust on PSP. Panic and allocation support. Access PSP system libraries.
Rust★ 814↓ 820/moJul 19, 2026
Custom licenseJul 19, 2026 · metrics 1.13.0
PyPI
32At riskhealth index
allure-framework/allure-python
Allure integrations for Python test frameworks
Python★ 811Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Go
30At riskhealth index
Restream/reindexer
Embeddable, in-memory, document-oriented database with a high-level Query builder interface.
C++ · Lex★ 808Jul 19, 2026
Apache-2.0Jul 19, 2026 · metrics 1.13.0
npm
44At riskhealth index
browserslist/update-db
CLI tool to update caniuse-lite to refresh target browsers from Browserslist config
JavaScript★ 807↓ 636M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm · PyPI
60Moderatehealth index
invergent-ai/surogate
Training/Fine-tuning at the speed of light
C++ · Python · Cuda★ 806↓ 0/moJul 21, 2026
Apache-2.0Jul 21, 2026 · metrics 1.13.0
npm
27Criticalhealth index
mathiasbynens/jsesc
Given some data, jsesc returns the shortest possible stringified & ASCII-safe representation of that data.
JavaScript★ 796↓ 638M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
phpstan/phpstan-symfony
Symfony extension for PHPStan
PHP★ 794↓ 2.3M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
Go
12Criticalhealth index
lesovsky/noisia
Harmful workload generator for PostgreSQL
Go★ 788Jul 23, 2026
BSD-3-ClauseJul 23, 2026 · metrics 1.13.0
RubyGems
34At riskhealth index
Envek/after_commit_everywhere
Use ActiveRecord transactional callbacks outside of models, literally everywhere in your application.
Ruby★ 786Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
crates.io
32At riskhealth index
sourcegraph/sg.nvim
Experimental Sourcegraph + Cody plugin for Neovim
Lua · Rust★ 782Jul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
crates.io
49At riskhealth index
actix/actix-net
A collection of lower-level libraries for composable network services.
Rust★ 773↓ 17.3M/moJul 19, 2026
Apache-2.0Jul 19, 2026 · metrics 1.13.0
Go · npm · PyPI
31At riskhealth index
lerd-env/lerd
Open-source, Herd-like local PHP development environment for Linux and macOS. Automatic .test domains, per-project PHP/Node isolation, one-command TLS. Podman-native, rootless.
Go★ 773Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
34At riskhealth index
CalebBell/thermo
Thermodynamics and Phase Equilibrium component of Chemical Engineering Design Library (ChEDL)
Python★ 765Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Go
49At riskhealth index
dbos-inc/dbos-transact-golang
Database-Backed Durable Golang Workflows
Go★ 764Jul 19, 2026
MITJul 19, 2026 · metrics 1.13.0
NuGet
31At riskhealth index
mganss/XmlSchemaClassGenerator
Generate C# classes from XML Schema files
HTML · C#★ 754Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
PyPI
27Criticalhealth index
xlwings/jsondiff
Diff JSON and JSON-like structures in Python
Python★ 748Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
Packagist
32At riskhealth index
nutgram/nutgram
The Telegram bot framework that doesn't drive you nuts.
PHP★ 742↓ 22.2K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
RubyGems
11Criticalhealth index
DmitryTsepelev/ar_lazy_preload
Lazy loading associations for the ActiveRecord models
Ruby★ 739Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
—
33At riskhealth index
libguestfs/libguestfs
library and tools for accessing and modifying virtual machine disk images.
C · OCaml★ 739Jul 20, 2026
GPL-2.0Jul 20, 2026 · metrics 1.13.0
Go
24Criticalhealth index
andybalholm/brotli
Pure Go Brotli encoder and decoder
Go★ 732Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
RubyGems · npm
38At riskhealth index
rmagick/rmagick
Ruby bindings for ImageMagick
C++ · Ruby★ 731Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
crates.io · PyPI
30At riskhealth index
saturneric/GpgFrontend
A modern, cross-platform OpenPGP tool with a unique dual-engine core: switch freely between the battle-tested GnuPG and a modern, memory-safe Rust rPGP backend. It makes encryption, signing, and key management easier and more trustworthy in everyday privacy workflows.
C++★ 730Jul 22, 2026
GPL-3.0Jul 22, 2026 · metrics 1.13.0
PyPI
27Criticalhealth index
wolverdude/GenSON
GenSON is a powerful, user-friendly JSON Schema generator built in Python.
Python★ 725Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
Packagist
42At riskhealth index
dflydev/dflydev-dot-access-data
Given a deep data structure representing a configuration, access configuration by dot notation.
PHP★ 723↓ 11.9M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
RubyGems
58Moderatehealth index
peterc/whatlanguage
Pure Ruby natural language detection library for 160+ languages.
Ruby★ 719Jul 21, 2026
Custom licenseJul 21, 2026 · metrics 1.13.0