Public-interest software inspection versioned methodology

A public record of software health.

Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.

01Evidence attached02Results independent of payment03Method versioned

Request a scan

Free for high public-value repositories. Private and niche repositories follow the documented certification route.

Public queue operational
↗
Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
◇
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
≈
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue

The record, as it stands.

Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.

Indexed repositories
37,472
Monthly downloads under inspection
379B
Median health index
57 Moderate

Red flags

Findings that adjust a rating downward rather than scoring into it. Selecting several shows repositories raising any of them.

Abandonment Malicious dependencies High-risk jurisdiction exposure Inorganic growth
Clear filters
1,238 recordsRanked by popularity · browse by tag · record statistics
crates.io
30At riskhealth index
LiteSVM/litesvm
No repository description published.
Rust★ 623Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Packagist · npm
32At riskhealth index
thedevdojo/auth
This is the repo for the DevDojo Auth package
Blade · PHP★ 623↓ 45.3K/moJul 18, 2026
MITJul 18, 2026 · metrics 1.13.0
Packagist
30At riskhealth index
shipmonk-rnd/composer-dependency-analyser
🚀 Fast detection of composer dependency issues (unused dependencies, shadow dependencies, misplaced dependencies)
PHP★ 622↓ 590.1K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
npm
49At riskhealth index
browserslist/caniuse-lite
A smaller version of caniuse-db, with only the essentials!
JavaScript★ 613↓ 722M/moJul 19, 2026
CC-BY-4.0Jul 19, 2026 · metrics 1.13.0
npm
33At riskhealth index
beaugunderson/ip-address
💻 a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript
TypeScript★ 612↓ 368M/moJul 22, 2026
MITJul 22, 2026 · metrics 1.13.0
npm
34At riskhealth index
dukeluo/eslint-plugin-check-file
ESLint rules for consistent filename and folder. Allows you to enforce a consistent naming pattern for the filename and folder.
JavaScript★ 608↓ 4.3M/moJul 23, 2026
Apache-2.0Jul 23, 2026 · metrics 1.13.0
PyPI
26Criticalhealth index
danthedeckie/simpleeval
Simple Safe Sandboxed Extensible Expression Evaluator for Python
Python★ 607Jul 21, 2026
Custom licenseJul 21, 2026 · metrics 1.13.0
PyPI
26Criticalhealth index
annotated-types/annotated-types
Reusable constraint types to use with typing.Annotated
Python★ 606↓ 751M/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
npm
34At riskhealth index
cmintey/wishlist
Wishlist is a self-hosted wishlist application that you can share with your friends and family. You no longer have to wonder what to get your family for the holidays, simply check their wishlist and claim any available item!
TypeScript · Svelte★ 602Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
34At riskhealth index
gmpy2/gmpy2
General Multi-Precision arithmetic for Python (GMP, MPIR, MPFR, MPC)
C · Python★ 594↓ 544.4K/moJul 21, 2026
LGPL-3.0Jul 21, 2026 · metrics 1.13.0
Hex
28Criticalhealth index
msz/hammox
🏝 automated contract testing via type checking for Elixir functions and mocks
Elixir★ 593↓ 81.5K/moJul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
Go
31At riskhealth index
gookit/config
📝 Go configuration manage(load,get,set,export). support JSON, YAML, TOML, Properties, INI, HCL, ENV and Flags. Multi file load, data override merge, parse ENV var. Go应用配置加载管理，支持多种格式，多文件加载，远程文件加载，支持数据合并，解析环境变量名
Go★ 586Jul 24, 2026
MITJul 24, 2026 · metrics 1.13.0
crates.io
36At riskhealth index
solana-foundation/surfpool
Surfpool is where developers start their Solana journey.
Rust★ 583Jul 20, 2026
Apache-2.0Jul 20, 2026 · metrics 1.13.0
PyPI
30At riskhealth index
mosquito/aiofile
Real asynchronous file operations with asyncio support.
Python★ 582↓ 73.3M/moJul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
—
28Criticalhealth index
mz-automation/lib60870
Official repository for lib60870 an implementation of the IEC 60870-5-101/104 protocol (read-only mirror)
C★ 582Jul 19, 2026
GPL-3.0Jul 19, 2026 · metrics 1.13.0
Packagist
31At riskhealth index
dg/bypass-finals
Removes `final` and `readonly` keywords from source code on-the-fly and allows mocking of final methods and classes. It can be used together with any test tool such as PHPUnit or Mockery.
PHP★ 573↓ 956.5K/moJul 24, 2026
Custom licenseJul 24, 2026 · metrics 1.13.0
—
24Criticalhealth index
Qalculate/qalculate-qt
Qalculate! Qt UI
C++★ 572Jul 20, 2026
GPL-2.0Jul 20, 2026 · metrics 1.13.0
PyPI
28Criticalhealth index
ionelmc/python-redis-lock
Lock context manager implemented via redis SET NX EX and BLPOP.
Python★ 570Jul 20, 2026
BSD-2-ClauseJul 20, 2026 · metrics 1.13.0
PyPI
38At riskhealth index
TheKevJames/coveralls-python
Show coverage stats online via coveralls.io
Python★ 569↓ 1.2M/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
46At riskhealth index
RDFLib/sparqlwrapper
A wrapper for a remote SPARQL endpoint
Python★ 567↓ 1.3M/moJul 21, 2026
Custom licenseJul 21, 2026 · metrics 1.13.0
NuGet
28Criticalhealth index
xBimTeam/XbimEssentials
A .NET library to work with data in the IFC format. This is the core component of the Xbim Toolkit
C#★ 567Jul 20, 2026
Custom licenseJul 20, 2026 · metrics 1.13.0
Packagist · RubyGems
46At riskhealth index
SocialConnect/auth
:atom: Social (OAuth1\OAuth2\OpenID\OpenIDConnect) sign with PHP :shipit:
PHP★ 565↓ 18.6K/moJul 23, 2026
MITJul 23, 2026 · metrics 1.13.0
npm
49At riskhealth index
lerna-lite/lerna-lite
Subset of Lerna in a much smaller & more modular project. Help manage and publish multiple packages in a monorepo/workspace structure
TypeScript★ 565Jul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
Go
31At riskhealth index
fastschema/fastschema
All-in-One Backend as a Service with Headless CMS Power
Go★ 563Jul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
crates.io
49At riskhealth index
rust-random/getrandom
A small cross-platform library for retrieving random data from (operating) system source
Rust★ 563↓ 155M/moJul 22, 2026
Apache-2.0Jul 22, 2026 · metrics 1.13.0
Packagist
33At riskhealth index
DirectoryTree/ImapEngine
Manage mailboxes using IMAP without the PHP extension
PHP★ 559↓ 43.8K/moJul 20, 2026
MITJul 20, 2026 · metrics 1.13.0
PyPI
28Criticalhealth index
pnuckowski/aioresponses
Aioresponses is a helper for mock/fake web requests in python aiohttp package.
Python★ 558↓ 10.2M/moJul 21, 2026
MITJul 21, 2026 · metrics 1.13.0
—
28Criticalhealth index
sebastienros/parlot
Fast and lightweight parser creation tools
C#★ 557Jul 20, 2026
BSD-3-ClauseJul 20, 2026 · metrics 1.13.0
npm
21Criticalhealth index
slopus/happy-cli
Happy Coder CLI to connect your local Claude Code to mobile device
TypeScript★ 557Jul 20, 2026
No licenseJul 20, 2026 · metrics 1.13.0
Packagist
36At riskhealth index
laminas/laminas-diactoros
PSR HTTP Message implementations
PHP★ 553↓ 3.3M/moJul 22, 2026
BSD-3-ClauseJul 22, 2026 · metrics 1.13.0