Docs Surveying a target
Buy side

Surveying a target you do not control

Most targets are private. Borehole never holds a target's source, so the target runs the collector on its own systems, with your key. What it sends: never whole files; facts and short excerpts of up to 120 characters where a check matched. The report is the target's until it chooses to share it with you.

If the repository is public

You need none of this. Run a repo survey on it.

If it is private: three steps

  1. You buy a Report and send its key to the target. The key is good for 30 days of surveys, private or public, counted from its first survey.
  2. The target adds the key to its own Borehole account, on the account page, and runs the collector in the repository. A key can be added to one account, so each further private target needs a Report of its own. 
    pip install -U borehole
borehole collect . --dry-run   # prints everything that would be sent, sends nothing
borehole collect .             # sends it, returns a report
    Or it runs the same collector in Confidential Compute in its own Google Cloud project, which lets you check that the facts were not edited on the way.
  3. The target decides who reads the report. A collected report is private to the account that ran it, and to anyone GitHub says controls the repository. Borehole's administrators can also open it, to run the service and answer support. You read it when the target sends you a share link. Anyone holding that link can read it, so treat it like the report. Terms, section 5.

Whose key, and whose report

The survey uses your Report: its 30 days start with the target's first survey if they have not started already. The report belongs to the target's account, not yours, because the target ran it on its own code. That is what makes it a fair ask of a target: it sees everything before you do, and nothing leaves its systems but facts.

The target accepts our data processing agreement when it makes its collector token. We process its developers' data on its instructions, not yours. When it shares the report with you, you decide for yourself what you do with what you receive.

What you can rely on

From the ordinary collector: the facts are what the target's machine sent. A target could edit them, and nobody could tell.

From Confidential Compute: Google Cloud attests which collector image ran, and the token it signs names the exact facts that image sent. The report and its verification page say so. It still does not prove the target surveyed its real codebase rather than a cleaned-up copy; the report names the remote and the commit it read, so ask for those.

If the target will not run it

Then the question is for the room. Hire us, and a person works through the target's code with its team.