Reproducible evidenceEvery published result links to inspectable source evidence and methodology.
Public-interest software inspection versioned methodology
A public record of software health.
Bridges, elevators, and food have condition records kept in public. The software underneath all three does not. This is that record: maintainability, engineering quality, security posture, ecosystem adoption, and governance, measured the same way for every repository.
01Evidence attached02Results independent of payment03Method versioned
Independent resultsPayment, sponsorship, and vendor alignment cannot alter a published result.
Signals, not warrantiesResults inform review and procurement; they do not replace expert judgement.
Live catalogue
The record, as it stands.
Every repository admitted so far, searchable and rankable, each entry opening on a full report with its evidence.
Indexed repositories
67,378
Repositories admitted to the public record — inspected, or queued for a first inspection. Unaffected by the catalogue filters below.
Monthly downloads under inspection
581B
Combined monthly package downloads across every indexed repository, as reported by package registries — the dependency footprint the public record covers.
Median health index
60 Moderate
The midpoint health index across all inspected repositories, computed under metrics 2.10.0 — a reference point for reading any individual result.
—
pulp/pulp_certguard
No repository description published.
No licenseAwaiting first inspection
crates.io
pulseengine/scry
sound abstract interpretation for WebAssembly — the third DO-333 leg of the PulseEngine verification chain
Apache-2.0Aug 28, 2026 · metrics 2.10.0
crates.io
pulseengine/sigil
Sigil — Supply chain security for WebAssembly. Embedded signatures, Sigstore keyless signing, SLSA provenance. Part of the PulseEngine toolchain.
No licenseAug 5, 2026 · metrics 2.10.0
Go
pulsoats/contracts
No repository description published.
No licenseAug 28, 2026 · metrics 2.10.0
Go
pulsoats/core
pulsoats-core — ядро с общими компонентами для биржевых интеграций, детекторов и WebSocket-транспорта.
No licenseAug 28, 2026 · metrics 2.10.0
Go
pulumi-labs/pulumi-exporter
OpenTelemetry Pulumi Cloud metrics exporter
MITJul 23, 2026 · metrics 2.10.0
Go · PyPI
pulumi/pulumi-coreweave
Pulumi provider for CoreWeave
Apache-2.0Aug 29, 2026 · metrics 2.10.0
Go · PyPI
pulumi/pulumi-ns1
A NS1 Pulumi resource package, providing multi-language access to NS1
Apache-2.0Sep 9, 2026 · metrics 2.10.0
Go · PyPI
pulumi/pulumi-null
No repository description published.
Apache-2.0Sep 8, 2026 · metrics 2.10.0
—
pump-fun/pump-swap-sdk
No repository description published.
No licenseAwaiting first inspection
—
pumulo/timber-common
No repository description published.
No licenseAwaiting first inspection
Go
punchcms/punchdb
Database Layer
No licenseJul 30, 2026 · metrics 2.10.0
Go
puneetdixit200/validator
:100:Go Struct and Field validation, including Cross Field, Cross Struct, Map, Slice and Array diving
MITSep 8, 2026 · metrics 2.10.0
Go
punk-one/edge-service-sdk
edge service sdk
Apache-2.0Aug 1, 2026 · metrics 2.10.0
RubyGems
puppetlabs-toy-chest/stringify-hash
A ruby hash object that treats symbols and strings interchangeably.
Apache-2.0Jul 20, 2026 · metrics 2.10.0
RubyGems
puppetlabs/beaker-vmpooler
VMPooler hypervisor library for beaker
Apache-2.0Jul 20, 2026 · metrics 2.10.0
—
puppetlabs/cem_acpt
No repository description published.
No licenseAwaiting first inspection
Go
puppetlabs/go-libs
go-libs is a set of common Go libraries
Apache-2.0Jul 29, 2026 · metrics 2.10.0
Go
puria/gg
`gg` is a small Go CLI that resolves a GitHub repository to a local checkout path, clones it if needed, and is designed to be wrapped by a shell function so `gg f credim` can still land you inside the repo.could not prompt
No licenseJul 23, 2026 · metrics 2.10.0
Go
purus-dev/aqua
轻量化 core s3 sdk
MITAug 26, 2026 · metrics 2.10.0
Packagist
push-in/pam-native-php
Composer distribution mirror for the PAM Native PHP SDK.
Apache-2.0Aug 22, 2026 · metrics 2.10.0
Packagist
push-in/pam-native-testing
Deterministic bridge fakes and assertions for PAM Native applications and plugins.
Apache-2.0Aug 23, 2026 · metrics 2.10.0
Go · npm
pushchain/push-chain-evm
An EVM compatible framework for blockchain development with the Cosmos SDK
Apache-2.0Sep 8, 2026 · metrics 2.10.0
npm
putianyi889/vue3-plots
Fully customizable Vue3 components for plots
MITJul 22, 2026 · metrics 2.10.0
crates.io
pvandervelde/github-bot-sdk
A Rust library for working with GitHub in a GitHub app
Apache-2.0Aug 22, 2026 · metrics 2.10.0
crates.io
pvandervelde/queue-runtime
No repository description published.
Apache-2.0Aug 22, 2026 · metrics 2.10.0
npm
pwngh/economy-lab
A provably-solvent credits economy: wallets, payouts, subscriptions, and a marketplace, on one double-entry ledger.
MITAug 3, 2026 · metrics 2.10.0
—
pxlvoid/basegrid
No repository description published.
No licenseAwaiting first inspection
Go
pydantic/pulumi-logfire
Logfire Pulumi provider
Apache-2.0Sep 5, 2026 · metrics 2.10.0
Packagist
pylesoft/composer-symlink-plugin
Composer plugin for symlinking local packages during development, without modifying composer.lock.
No licenseAug 29, 2026 · metrics 2.10.0