Surveying a target

Buy side

Surveying a target you do not control

Most targets are private. Borehole never holds a target's source, so the target runs the collector on its own systems, with your key, and sends facts about the repository, never whole files. The report is the target's until it chooses to share it with you.

If the repository is public

You need none of this. Run a repo survey on it.

If it is private: three steps

You buy a Report and send its key to the target. The key is good for 30 days of surveys, private or public, counted from its first survey.
The target adds the key to its own Borehole account, on the account page, and runs the collector in the repository:
```
pip install borehole
borehole collect . --dry-run   prints everything that would be sent, sends nothing
borehole collect .             sends it, returns a report
```
Or it runs the same collector in Confidential Compute in its own Google Cloud project, which lets you check that the facts were not edited on the way.
The target decides who reads the report. A collected report is private to the account that ran it, and to anyone GitHub says controls the repository. You read it when the target sends you a share link. Anyone holding that link can read it, so treat it like the report.

Whose key, and whose report

The survey uses your Report: its 30 days start with the target's first survey if they have not started already. The report belongs to the target's account, not yours, because the target ran it on its own code. That is what makes it a fair ask of a target: it sees everything before you do, and nothing leaves its systems but facts.

What you can rely on

From the ordinary collector: the facts are what the target's machine sent. A target could edit them, and nobody could tell.

From Confidential Compute: Google signs the exact facts our published collector image sent, and the report and its verification page say so. It still does not prove the target surveyed its real codebase rather than a cleaned-up copy; the report names the remote and the commit it read, so ask for those.

If the target will not run it

Then the question is for the room. Hire us, and a person works through the target's code with its team.