The parts that are kept private are: [2]

• models/admintools.py — some of it, though what's there is very interesting
  • admin_ratelimit(user)
  • is_banned_domain(dom)
  • is_shamed_domain(dom)
  • bans_for_domain_parts(dom)
  • valid_user(v, sr, karma, *a, **kw)
  • apply_updates(user)
• lib/admin_utils.py — all of it
  • modhash(user, rand=None, test=False) — this generates the X-Modhash: header that's used for anti-CSRF purposes
  • valid_hash(user, hash)
  • check_cheating(loc)
  • vote_hash()
• lib/validator/__init__.py — all of the constructor
• lib/count.py — most of it
  • incr_counts(wrapped)
  • incr_sr_count(sr)
• lib/pages/pages.py
  • There's a note saying: "The IP tracking code is currently deeply tied with spam prevention stuff. This will be open sourced as soon as it can be decoupled."
  • ips_by_account_id(account_id)
• lib/pages/admin_pages.py — some of it
• lib/validator/validator.py — none of it, just hooked