Page 1 of 1

Source Code Information Request

Kickdrum provides code evaluation services that help companies understand and manage source code, open source software, and other components that constitute a software codebase. Kickdrum has been asked by our client to conduct a Source Code Evaluation and/or Open Source Risk Assessment. 

If you have any questions or difficulties, please contact: code [at] kickdrum [dot] com
NOTE: This form will save your answers as you go, so you can leave it and return later.

Contact Information

Source Code Management (SCM)

What source code management (SCM) systems are being used?

What source code management (SCM) systems are being used?

Where are the SCM instances hosted?

Where are the SCM instances hosted?

Is any source code managed outside of an SCM system?

Is any source code managed outside of an SCM system?
A
B

Build, Packaging, & Dependencies

What package / dependency managers are in-use?

What package / dependency managers are in-use?

Are any private or self-managed package repositories or caches used?

Are any private or self-managed package repositories or caches used?

Does the build process leverage containers (e.g., Docker)?

Does the build process leverage containers (e.g., Docker)?
A
B
C

Are documented instructions or automated processes available to build all components from source code in a clean environment?

Are documented instructions or automated processes available to build all components from source code in a clean environment?
A
B

Products, Applications, & Repositories

Please identify the products, applications, or similar top-level entities contained in the codebase, and include a short description of each.

Typically Kickdrum thinks of a product as a separately licensable entity by its customers. Depending on the nature of your business this could be distributed software, a SaaS-based web application, a module in a larger scale application, etc.

Were all of these products / applications written by the same team?

Were all of these products / applications written by the same team?
A
B

Did any of these products / applications originate from a corporate acquisition, third-party asset purchase, or similar?

Did any of these products / applications originate from a corporate acquisition, third-party asset purchase, or similar?
A
B

Do your engineers use Copilot, ChatGPT, or similar generative AI models when writing code?

Do your engineers use Copilot, ChatGPT, or similar generative AI models when writing code?
A
B
C
D
E

Do any repositories contain source code or binaries originating or derived from open source projects?

Do any repositories contain source code or binaries originating or derived from open source projects?

Has any open source software been modified, forked, or published?

Has any open source software been modified, forked, or published?

Please provide the following details about each code repository:

Repository name / ID (or base folder location within the codebase structure)
Application / Product to which the repository belongs
Purpose - describe whether each repository is internal use tooling or distributed and/or hosted
Primary programming languages and versions (Java 11, C# 8, Python 3, Angular 10, T-SQL 2017)
Lines of code - estimated/ballpark count is okay - please consider using a tool like "cloc" or "scc" to count the lines of code per repository with a breakdown by file extension
Enter details here...
Or download this XLSX template: https://kickdrum.com/s/Source-Code-Information-Repositories.xlsx
Then, upload the completed template here:

Open Source Software Policies, Procedures, & Inventory

Please upload a copy of your policies and procedures around open source usage and approved licenses (if available).

Please upload an inventory / report containing details of third-party commercial and open source components. Please include reports from a Software Composition Analysis (SCA) tool, such as Black Duck, Mend, FossID, or Snyk (if available).

Source Code Access

Up to three Kickdrum team members will require read-only access to the SCM instances, with multi-factor authentication (MFA) enabled, to clone the code to a secure analysis environment. Please advise if there are any challenges or concerns with respect to providing this access:

Up to three Kickdrum team members will require read-only access to the SCM instances, with multi-factor authentication (MFA) enabled, to clone the code to a secure analysis environment. Please advise if there are any challenges or concerns with respect to providing this access:
A
B