The public record
See what Watchdog finds in real projects.
Every report on this page comes from a Watchdog survey of a real project. Most of the projects are open source, and Watchdog surveys them on its own initiative, to test its checks on real code.
Each report shows the project's score and what holds it back, the problems ranked by what to fix first with the file and line of each, and the version of the rules every grade was calculated under. Only the security details are blanked out, so that a public report never shows where a project can be attacked. The security grade and the number of security findings are still there.
You can read the reports before you connect any code of your own, with no account and nothing to install. Start with a project you may know, such as 3b1b/manim or huggingface/smolagents.
Sign in with GitHub, GitLab, Bitbucket or Azure DevOps · no card · every language we cover · the first survey of every repository you connect is free, with nothing held back.
Thousands
of reports on real projects, with new ones added as Watchdog publishes them
Your language
The full list can be filtered by programming language, so you can find a project like yours.
No account
Read any report without signing up or installing anything.
€0
for the first survey of every repository you connect
From the public record
See how Watchdog graded the highest-scoring project in each language.
Each card shows the highest-scoring project in one programming language, with the highest score first. The number marked CAI is the project's score on the Code Assurance Index, an open standard for grading code from 0 to 100. The bar under it shows where that score falls on the scale from Critical, on the left, to Exemplary, and the label in the corner names the band. The card also counts the lenses measured, meaning the areas of the code Watchdog graded for that project. Some areas apply only to products built in a certain way, so the count differs from project to project. What we measure explains each grade and band.
Every other published report is in the full list, where you can filter by programming language and by area.
CodeAssuranceIndexby code-assurance-initiative
StrongCAI88/ 100
5 lenses measured · C#
Android-Clean-Architectureby happysingh23828
StrongCAI74/ 100
5 lenses measured · Kotlin
Showing 24 of 4,862 published surveys.
Straight from the reports
Watchdog points each design problem to its file and line.
These findings come from three published reports. Each list shows a few of the problems Watchdog found in one project, and the count above it shows how many the whole report holds.
They are problems in how a product is designed, of the kind Watchdog looks for in products built around a model of the business, or around events passed between their parts. One example is a change that is saved and then announced to the rest of the system in two separate steps, so that one step can happen without the other. Another is a piece of the data that holds information but none of the rules for it, so the rules end up scattered across the code. Each finding names the file and line where it sits. What we measure explains these areas, and why Watchdog grades them only in products designed this way.
leytonoday/Atlas-API-Modular-Monolith
4 of 78 findings
- Event-DrivenDual write (no outbox): CreateUserCommandHandler persists, ProcessInboxCommandHandler publishessrc/Modules/Users/Atlas.Users.Application/CQRS/Users/Commands/CreateUser/CreateUserCommandHandler.cs:9
- Domain ModellingAggregate holds a reference to another aggregate: Feature.Planssrc/Modules/Plans/Atlas.Plans.Domain/Entities/FeatureEntity/Feature.cs:43
- Domain ModellingRepository for a non-root entity: EurLexSumDocumentRepository → EurLexSumDocumentsrc/Modules/Law/Atlas.Law.Infrastructure/Persistance/Repositories/EurLexSumDocumentRepository.cs:8
- Domain ModellingAnemic entity: EurLexSumDocumentsrc/Modules/Law/Atlas.Law.Domain/Entities/EurLexSumDocumentEntity/EurLexSumDocument.cs:9
MarsonShine/MS.Microservice
4 of 35 findings
- Domain ModellingAnemic entity: Actionsamples/Lab/MS.Microservice.Lab.Domain/Aggregates/IdentityModel/Action.cs:6
- Domain ModellingRepository for a non-root entity: LogRepository → LogAggregateRootsamples/Lab/MS.Microservice.Lab.Persistence/Repository/LogRepository.cs:14
- Domain ModellingPrimitive data clump: [currency, customerid, orderid]samples/Lab/MS.Microservice.Lab.Domain/Aggregates/OrderAggregate/OrderMessages.cs:8
- Domain ModellingMutable entity: Actionsamples/Lab/MS.Microservice.Lab.Domain/Aggregates/IdentityModel/Action.cs:6
mehdihadeli/food-delivery-modular-monolith
4 of 80 findings
- Event-DrivenDual write (no outbox): DeleteRestockSubscriptionsByTimeHandler.Handlesrc/Modules/Customers/FoodDelivery.Modules.Customers/RestockSubscriptions/Features/DeletingRestockSubscriptionsByTime/DeleteRestockSubscriptionsByTime.cs:31
- Domain ModellingAggregate holds a reference to another aggregate: Product.Categorysrc/Modules/Catalogs/FoodDelivery.Modules.Catalogs/Products/Models/Product.cs:34
- Domain ModellingAnemic entity: Aggregatesrc/BuildingBlocks/BuildingBlocks.Core/Domain/Aggregate.cs:9
- Domain ModellingDomain uses infrastructure in a method body: ChangingProductBrandValidationHandlersrc/Modules/Catalogs/FoodDelivery.Modules.Catalogs/Products/Features/ChangingProductBrand/Events/Domain/ChangingProductBrand.cs:12
Before you open one
Where to look first when you open a report.
Every report follows the same order, from a short summary to the evidence behind each grade. These are the parts that show most about a project. A customer's own survey also includes four reports written for different readers and a list of every library the code uses, which What you get describes.
The score, and what holds it back
The report opens with the project's score and a short summary in plain words. Each area then gets its own grade, and where a grade is held down, the report names the check that holds it.
What to fix first
A short list of top priorities shows which fixes would raise the score most, and a roadmap puts the rest in order.
Where the risk sits in the history
Watchdog also reads the project's change history. The report shows the files that change most often while being hardest to work in, and the parts of the code that only one person knows. In a public report, names are replaced by numbers.
What Watchdog did not check
Each report has a section on what Watchdog did not check in that project, and why, such as the live systems the code runs on. A reader can see what the score covers and what it leaves out.
How the score was calculated
The report names the version of the rules it was graded under, and its audit trail lists the measurements behind the score. Anyone can recalculate the score from them with the open calculation program.
Two files to download
A findings file that other code tools can import (SARIF), with security weaknesses tagged by their number in the standard list (CWE), and a changelog of what moved since the previous survey. In a public report, security details are withheld in the files too.
How reports get here
Most reports here come from open-source projects that Watchdog surveys on its own initiative, to test its checks on real code, and those reports are always public. A customer's report appears here only if its owner chooses to publish it, on any plan. Each project shows its latest full survey, whether the score went up or down since the one before, and the changelog in each report shows what moved.
The Code Assurance Index keeps its own list of measured codebases, and it counts more, because it also includes scores for code whose source is not public. The standard also keeps a register of signed deliveries, where a survey handed to a customer or a buyer can be checked. Both are open to any tool that implements the standard, and today Watchdog is the only one that does.
Get a report like these for your own code. Your first survey is free, with nothing held back.
Sign in with GitHub, GitLab, Bitbucket or Azure DevOps · no card · every language we cover · your own reports stay private until you choose to publish them.
Next: From code host to your first baseline · Architecture drawn from the code, or browse all the guides.
More about Watchdog: What we measure · What you get · Which languages we cover · Security and data.