Borehole
Technical due diligence, read from the repository itself
One time feeCode954 impressions#13 this week3 comments
Comments
>log in to comment- Aditya Goel· 2d ago
Citing every finding to commit, path and lines is what makes this usable in a deal. How does it cope when the history itself is misleading: a seller who squashed or rewrote history before the data room, or code moved in from another repo so one person looks like the author of everything? A check that flags "history starts suspiciously late" or large vendored folders would stop the bus-factor and ownership findings from being read at face value. Do licence checks (GPL code inside a closed product) sit in the 106 too?
Thanks Aditya, this is exactly the right worry, and you've found two real gaps. What it catches today: a repository that starts with most of itself already written (a first commit carrying 40% or more of every line ever added), code arriving faster than anyone could write it, and mirrors or exports, where the report says the people checks are reading an export, not the team. The bus factor counts commits, not lines, so one big import counts once. The gaps: nothing compares when the history starts with how old the code says it is, and the people findings don't point back to those import flags. Both are good ideas, and I'm adding them: a caveat on the people findings whenever the history looks imported, and a "history starts late" check against copyright years and changelogs. Licences: yes. Check 05.7 is your exact case, copyleft code inside a product that isn't itself copyleft. Three more cover licence conflicts, third-party code with no licence, and unclear grants. Thanks for this feedback and the ideas I'm adding now!
Hi DevHunt 👋 I'm Andrew. Before Borehole I did technical due diligence on dozens of Amazon deals. Borehole reads a repository's git history and writes the report a deal team asks for: 106 checks, seven dimensions, every finding cited to the commit, path and lines it rests on. Public repositories are free to try. If a finding looks wrong on a repository you know well, tell me. Wrong findings are bugs, and I fix them.
Borehole is technical due diligence for software acquisitions and investments, read from the repository itself.
Paste a repository address. Borehole reads the git history and the working tree, runs 107 diligence checks and rates seven dimensions a deal team cares about: architecture, engineering process, key-person risk, product maturity, security, operations, and fit with the acquirer. Every finding cites the commit, path and lines it rests on, or, when something is missing, what was looked for. What the code can't answer becomes a question for the room.
Public repositories are free, and so are three private surveys in any 30 days after a GitHub sign-in. Private repositories are read on your own machine by the collector (pip install borehole), which sends facts and short excerpts of up to 120 characters where a check matched, never whole files. Its dry run prints everything it would send, first.
More Code tools →74 free dev tools →
- 106 diligence checks across seven dimensions
- Supports GitHub, GitLab, Azure DevOps, Bitbucket, Codeberg, Gitea, SourceHut
- Every finding cites its evidence with commit, path and line numbers
Borehole runs automated technical due diligence on a repository, rating architecture, process, security, and more.
- for
- Investors, acquirers, and deal teams evaluating software assets.
- pricing
- freemium
Key features
- 107 diligence checks — Analyzes git history and working tree across seven deal-team dimensions.
- Evidence citations — Each finding shows commit, file path and line range or what was searched for.
- Private-code safe collector — Runs locally via pip, sending only short excerpts (≤120 chars), never full files.
- Free public surveys — Survey any public repository free, with no sign-in. Every finding cites its evidence.
- Report tier — 30 days of unlimited surveys at full depth, the one-page buyer's summary, and reliance for the buyer named on the order.
- Hire-us option — Custom engagement covering all seven dimensions, including fit with the acquirer.
Use cases
- Validate the architectural health of a target startup before acquisition.
- Identify security and operational risks in a candidate repository.
- Generate a buyer-ready due-diligence report for investors.
- Assess key-person risk by analyzing commit history and contribution patterns.
Borehole pricing
- Repo surveyFreeAny public repository, no sign-in · Three free private surveys in any 30 days (GitHub sign-in) · Private code read on your own machine · Every finding cites its evidence
- Report€249/report (launch price)One-page buyer's summary · Reliance for the buyer named on the order · 30 days of unlimited surveys at full depth
- Hire us€12,000+Led by Andrew Edmond · Buy-side diligence, sell-side readiness, post-close integration · Total price set per engagement
Borehole vs alternatives
 Borehole |  Semgrep |  GitHub |  Calljmp |  Gitea | |
|---|---|---|---|---|---|
| Best for | Automated repo-based diligence checks | Finding bugs and security issues | Repository hosting and CI | AI-driven code automation | Self-hosted Git hosting |
| Pricing | Freemium | Subscription | Subscription | Free | Free |
| DevHunt upvotes | 3 | 0 | 0 | 35 | 0 |
| Launched | Nov 2026 | — | — | Feb 2026 | — |
- Borehole vs Semgrep: Static analysis only, no git-history or private-code handling
- Borehole vs GitHub: General code hosting platform, not a dedicated diligence tool
- Borehole vs Calljmp: AI-agent backend for code tasks, not focused on due-diligence reporting
- Borehole vs Gitea: Self-hosted Git service, does not provide automated diligence checks
Borehole FAQ
Does Borehole keep my private code?+
No. The collector runs on your machine and sends only facts and short excerpts of up to 120 characters where a check matched, never whole files. Its dry run prints everything it would send, first.
What’s included in the free survey?+
A survey of any public repository, free and with no sign-in, with every finding cited. After a GitHub sign-in, three free private surveys in any 30 days, read on your own machine by the collector.
How does a Report differ from hiring a person?+
A Report provides automated, full-depth analysis for 30 days; hiring a person adds live-system, team and contract assessment.
Can I get a refund if the report is insufficient?+
Yes, within 30 days you can request a full refund if the report has no findings with evidence or doesn’t meet the described scope.
What repositories can I analyze?+
Public repos on GitHub, GitLab, Azure DevOps, Bitbucket, Codeberg, Gitea, SourceHut, and private repos via the local collector.
Edited by the makers, based on borehole.dev · Oct 25, 2026. Details may change; check the official site.
