I've done technical due diligence on acquisitions for years. Most of what changes a deal is answerable from the repository: does the team review its code, does one person carry the recent work, did the licence just change, are releases cut from what's on main, do the tests run in CI. So I built a tool that reads all of that from the history and working tree, and writes a report a deal team can act on.
Seven dimensions, 100+ deterministic checks. No model writes the findings.
Every finding cites a commit, a file or a line.
What code can't settle becomes a question for a person, not a guess.
Public repositories are free: paste a GitHub, GitLab, Codeberg or SourceHut address at borehole.dev.
Private repositories never reach our servers. pip install borehole, then borehole collect . --dry-run prints exactly what would be sent: counts, paths, short matched lines, hashed author identities. Never whole files.
The technology is new, and I'd rather hear about issues here than not. The first 20 people who email support@borehole.dev with "HN beta" get a free Report key for their own private repository, in exchange for a short survey after the report.
Website: https://borehole.dev/
Example report: https://borehole.dev/r/rustdesk/rustdesk/b5d8b97
Comments URL: https://news.ycombinator.com/item?id=49954718
Points: 1
# Comments: 0