Comments
>log in to commentHi DevHunt 👋 I'm Andrew. Before Borehole I did technical due diligence on dozens of Amazon deals. Borehole reads a repository's git history and writes the report a deal team asks for: 106 checks, seven dimensions, every finding cited to the commit, path and lines it rests on. Public repositories are free to try. If a finding looks wrong on a repository you know well, tell me. Wrong findings are bugs, and I fix them.
Borehole is technical due diligence for software acquisitions and investments, read from the repository itself.
Paste a repository address. Borehole reads the git history and the working tree, runs 106 diligence checks and rates seven dimensions a deal team cares about: architecture, engineering process, key-person risk, product maturity, security, operations, and fit with the acquirer. Every finding cites the commit, path and lines it rests on, or, when something is missing, what was looked for. What the code can't answer becomes a question for the room.
Public repositories are free. Private repositories are read on your own machine by the collector (pip install borehole), which sends facts and short excerpts of up to 120 characters where a check matched, never whole files. Its dry run prints everything it would send, first.
- 106 diligence checks across seven dimensions
- Supports GitHub, GitLab, Azure DevOps, Bitbucket, Codeberg, Gitea, SourceHut
- Every finding cites its evidence with commit, path and line numbers
Borehole runs automated technical due diligence on a repository, rating architecture, process, security, and more.
- for
- Investors, acquirers, and deal teams evaluating software assets.
- pricing
- freemium
Key features
- 106 diligence checks — Analyzes git history and working tree across seven deal-team dimensions.
- Evidence citations — Each finding shows commit, file path and line range or what was searched for.
- Private-code safe collector — Runs locally via pip, sending only short excerpts (≤120 chars), never full files.
- Free public surveys — Run unlimited surveys on public repos without any access or cost.
- Report tier — Full-depth analysis for 30 days, includes PDF export, diff view and buyer summary.
- Hire-us option — Custom engagement covering all seven dimensions, including fit with the acquirer.
Use cases
- Validate the architectural health of a target startup before acquisition.
- Identify security and operational risks in a candidate repository.
- Generate a buyer-ready due-diligence report for investors.
- Assess key-person risk by analyzing commit history and contribution patterns.
Borehole pricing
- Repo surveyFreeAny public repository · Cites evidence · Dry-run for private repos
- Report€249/report (launch price)Full-depth checks · 30 days of surveys · PDF export
- Hire us€12,000+All seven dimensions · Custom scope · On-site engagement
Borehole vs alternatives
 Borehole |  Semgrep |  GitHub |  Calljmp |  Gitea | |
|---|---|---|---|---|---|
| Best for | Automated repo-based diligence checks | Finding bugs and security issues | Repository hosting and CI | AI-driven code automation | Self-hosted Git hosting |
| Pricing | Freemium | Subscription | Subscription | Free | Free |
| DevHunt upvotes | 1 | 0 | 0 | 35 | 0 |
| Launched | Nov 2026 | — | — | Feb 2026 | — |
- Borehole vs Semgrep: Static analysis only, no git-history or private-code handling
- Borehole vs GitHub: General code hosting platform, not a dedicated diligence tool
- Borehole vs Calljmp: AI-agent backend for code tasks, not focused on due-diligence reporting
- Borehole vs Gitea: Self-hosted Git service, does not provide automated diligence checks
Borehole FAQ
Does Borehole keep my private code?+
No. The collector runs on your machine and only sends short excerpts, never whole files.
What’s included in the free survey?+
One free survey of any public repository per 30 days, with evidence citations and a dry-run option for private repos.
How does a Report differ from hiring a person?+
A Report provides automated, full-depth analysis for 30 days; hiring a person adds live-system, team and contract assessment.
Can I get a refund if the report is insufficient?+
Yes, within 30 days you can request a full refund if the report has no findings with evidence or doesn’t meet the described scope.
What repositories can I analyze?+
Public repos on GitHub, GitLab, Azure DevOps, Bitbucket, Codeberg, Gitea, SourceHut, and private repos via the local collector.
Summarized by DevHunt from borehole.dev · Oct 25, 2026. Details may change; check the official site.
