Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
97,261
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
647B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
59 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
Kind
What the repository builds — library, application, host extension. Repositories whose evidence answers nothing are listed under Unclassified.
Red flags
Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.
Go
jung-kurt/gofpdf
A PDF document generator with high level support for text, drawing and images
MITOct 18, 2026 · metrics 2.10.0
—
canonical/dqlite
Embeddable, replicated and fault-tolerant SQL engine.
Custom licenseOct 18, 2026 · metrics 2.10.0
Maven
powermock/powermock
PowerMock is a Java framework that allows you to unit test code normally regarded as untestable.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
AlecAivazis/survey
A golang library for building interactive and accessible prompts with full support for windows and posix terminals.
MITOct 21, 2026 · metrics 2.10.0
Maven
apache/tika
The Apache Tika toolkit detects and extracts metadata and text from over a thousand different file types (such as PPT, XLS, and PDF).
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Packagist
LaravelCollective/html
HTML and Form Builders for the Laravel Framework
MITOct 20, 2026 · metrics 2.10.0
crates.io
async-rs/async-std
Async version of the Rust standard library
Apache-2.0Oct 20, 2026 · metrics 2.10.0
Go
roboll/helmfile
Deploy Kubernetes Helm Charts
MITOct 21, 2026 · metrics 2.10.0
—
fatih/structs
Utilities for Go structs
MITOct 21, 2026 · metrics 2.10.0
Go
go-gorp/gorp
Go Relational Persistence - an ORM-ish library for Go
MITOct 21, 2026 · metrics 2.10.0
—
rcrowley/go-metrics
Go port of Coda Hale's Metrics library
Custom licenseOct 21, 2026 · metrics 2.10.0
Packagist
zephir-lang/zephir
Zephir is a compiled high-level language aimed to ease the creation of C-extensions for PHP
MITOct 22, 2026 · metrics 2.10.0
crates.io · PyPI
servo/webrender
A GPU-based renderer for the web
MPL-2.0Oct 20, 2026 · metrics 2.10.0
Go
valyala/quicktemplate
Fast, powerful, yet easy to use template engine for Go. Optimized for speed, zero memory allocations in hot paths. Up to 20x faster than html/template
MITOct 18, 2026 · metrics 2.10.0
npm · RubyGems · Maven
twitter/twitter-text
Twitter Text Libraries. This code is used at Twitter to tokenize and parse text to meet the expectations for what can be used on the platform.
Apache-2.0Oct 20, 2026 · metrics 2.10.0
PyPI
datachain-ai/datachain
The Context Layer for unstructured data: typed, versioned datasets over S3, GCS, Azure
Apache-2.0Oct 21, 2026 · metrics 2.10.0
crates.io
apache/horaedb
Apache HoraeDB (incubating) is a high-performance, distributed, cloud native time-series database.
Apache-2.0Oct 21, 2026 · metrics 2.10.0
Maven
bucket4j/bucket4j
Java rate limiting library based on token-bucket algorithm.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
npm
websockets/wscat
WebSocket cat
MITOct 22, 2026 · metrics 2.10.0
Packagist
PHP-DI/PHP-DI
The dependency injection container for humans
MITOct 20, 2026 · metrics 2.10.0
—
yuru7/HackGen
Hack と源柔ゴシックを合成したプログラミングフォント 白源 (はくげん／HackGen)
Custom licenseOct 20, 2026 · metrics 2.10.0
Go
GeertJohan/go.rice
go.rice is a Go package that makes working with resources such as html,js,css,images,templates, etc very easy.
BSD-2-ClauseOct 21, 2026 · metrics 2.10.0
Go
xanzy/go-gitlab
GitLab Go SDK
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Maven
ytsaurus/ytsaurus
YTsaurus is a scalable and fault-tolerant open-source big data platform.
Apache-2.0Oct 19, 2026 · metrics 2.10.0
Go
chzyer/readline
Readline is a pure go(golang) implementation for GNU-Readline kind library
MITOct 21, 2026 · metrics 2.10.0
PyPI
sevagas/macro_pack
macro_pack is a tool by @EmericNasi used to automatize obfuscation and generation of Office documents, VB scripts, shortcuts, and other formats for pentest, demo, and social engineering assessments. The goal of macro_pack is to simplify exploitation, antimalware bypass, and automatize the process from malicious macro and script generation to final document generation. It also provides a lot of helpful features useful for redteam or security research.
Apache-2.0Oct 21, 2026 · metrics 2.10.0
crates.io
RustCrypto/hashes
Collection of cryptographic hash functions written in pure Rust
No licenseOct 20, 2026 · metrics 2.10.0
Maven
spring-attic/spring-retry
No repository description published.
Custom licenseOct 20, 2026 · metrics 2.10.0
RubyGems
thoughtbot/shoulda
Makes tests easy on the fingers and the eyes
MITOct 20, 2026 · metrics 2.10.0
crates.io
Sh1Yo/x8
Hidden parameters discovery suite
GPL-3.0Oct 17, 2026 · metrics 2.10.0