This is a report. How to read one.

A public repository

1. Paste its address, from GitHub, GitLab, Azure DevOps, Bitbucket, Codeberg, Gitea or SourceHut. No account, and no access to anything of yours.
2. Borehole's worker clones it and reads it: the history and the working tree, at one commit. The clone uses no credential and is deleted when the survey ends.
3. The report is public, and listed in the library.
4. A paid survey gets a second read. A language model reads each finding against the code, and withdraws one it judges the code contradicts. The report says which and why. It never adds a finding and never raises a band. How the pieces fit.

A private repository, on your machine

1. The collector reads it where it lives: your laptop, your CI or a server of yours.
2. It sends what the checks need: never whole files; facts and short excerpts of up to 120 characters where a check matched. The dry run prints all of it, and sends nothing.
3. The report is private to your account. Sending takes a Report key.

pip install -U borehole
borehole collect . --dry-run

A private repository, in your own cloud

1. The same collector runs in Confidential Compute, in your own Google Cloud project.
2. Google Cloud attests which collector image ran, and signs the facts it sends. The report carries that signature.
3. A buyer can check the facts were not edited, without trusting you or us.

Run it in your own cloud →

A private target you're buying

1. You send the target your key.
2. The target runs the collector on its own systems, or in its own cloud, and sees the report first.
3. The target decides who reads it, and shares the link with you.

Surveying a target →