Software Product Companies
Turn private engineering history into training-ready tasks.
Your repositories hold years of real engineering work: issues raised, patches written, reviews given and tests that prove the fix. AI labs need exactly this kind of verified, real-world task history.
No files to upload. No commitment to sell.
A product engineering team spends its week turning reports into shipped fixes. An issue arrives with a reproduction, an engineer opens a branch, CI goes red, a reviewer pushes back, the patch is revised and the tests go green. After a few years, your repositories hold a detailed record of how your team reasons about code.
That history is what we mean by data here: the records your company keeps while doing its work. Commits, issues, pull requests, review threads and CI runs, mostly never written for anyone outside the team.
Public code mostly shows the final state. Coding models, including the assistants in applications like ChatGPT, also need the path: the bug as reported, the first attempt, the reviewer’s correction and the test that proves the fix. Linked, verifiable chains like that are hard to find in public repositories.
What in your engineering history could be worth money — and why
Issue → pull request → merge, with test evidence
A closed issue linked to its fixing PR, plus a test that failed before and passes after, is a complete task: problem, solution and objective check. A buyer can re-run it for training or evaluation.
Review threads that changed the patch
Reviewer corrections capture senior judgement: the missed edge case, the safer migration, the simpler approach. Threads where the approach changed, not just the formatting, are the most valuable part of most histories.
CI history and reproducible environments
Red-then-green runs prove the fix did something. If builds can still be reproduced through lockfiles or pinned images, each task can be re-verified long after merge. Flaky suites and expired CI logs reduce the value.
Records that are usually less useful
Generated code, vendored dependencies and automated version-bump PRs add volume without judgement. One-word commits with no linked issue, heavily squashed history and untested repositories are hard to turn into verifiable tasks. Forks of open-source projects are usually not yours to offer.
Not every repository can be sold. Ownership, licences, secrets and customer information decide the scope.
Three examples from engineering teams
The three examples below are illustrative. Each is a complete chain — problem, patch, review and verification — which is the unit that matters to buyers.
Issue to verified patch
A customer reported that CSV exports dropped rows containing non-ASCII names. An issue was opened with a reproduction file.
An engineer opened a pull request fixing the encoding in the export service and added a failing test. A reviewer asked for the fix to cover the streaming path too; the engineer revised the patch.
CI went from red to green, the PR was merged and the issue was closed with a release note.
Why it’s useful
Issue, patch, review correction and passing tests together form a verifiable task that can train and evaluate coding models.
We check what you own and are allowed to share. Private details and restricted information stay out.
A slow endpoint. A profiled fix.
p95 latency on /search rose from 180 ms to 1.2 s after a release.
Engineer profiled it, found an N+1 query and added a join plus an index.
Load test back under 200 ms; regression test added to CI.
Why it’s useful
Issue, profiling evidence, patch and benchmark form a verifiable task. It can train and evaluate models on diagnosing performance problems, not just writing code.
We check what you own and are allowed to share. Private details and restricted information stay out.
A risky schema change. A safe rollout.
A column rename would break two downstream services.
Reviewer required an expand-and-contract migration in three PRs.
Rolled out with zero downtime; old column dropped a week later.
Why it’s useful
Review threads that change the approach are rare, high-value training signal. They show how senior engineers reduce risk, not only how code is written.
We check what you own and are allowed to share. Private details and restricted information stay out.
Secrets, customers, clients and licences: what stays out
Secrets
Credentials, API keys, tokens, certificates and environment files are scanned for across the full history, not just the current head; a key deleted years ago still lives in old commits. Anything found is removed before human review.
Customer information
Customer records turn up in fixtures, seed files, logs, test databases and screenshots in issues. These are excluded or replaced with synthetic values. Stripping names is not always enough: a customer-specific config can still point to one account, so some material is left out entirely.
Client-owned and licence-restricted code
If you build for clients, code they own stays out unless the client agrees. We read any confidentiality agreement, a written promise to keep a client’s information secret, often called an NDA, before scoping. Open-source and vendored code is checked against its licence; commercial SDKs and code whose terms restrict redistribution stay out.
People, roadmap and security
Contributor identities are pseudonymised, and pseudonymised data is still treated as personal data. You can exclude repositories, paths or periods that reveal your roadmap, and known unpatched vulnerabilities stay out.
Our AI-assisted check flags possible restrictions: secret patterns, licence headers, client names, personal details. Appropriate people then review rights and privacy. It is not an automated legal approval, and nothing leaves until you approve it.
Your records. Your choice. You approve the package before it is shared.
How we protect your informationHistorical packages and ongoing supply
Two separate offers. You can choose one, both or neither.
Is this right for your business?
A good fit
Product companies that own their code, with several years of history in a tracker, PRs that reference issues, a real test suite, CI and an active review culture.
Probably not a fit (yet)
Agencies whose code mostly belongs to clients who have not agreed. Very young codebases, repositories that are largely forks, and projects with no tests.
What to have ready
List your repositories, trackers and CI systems, and which you own outright. Flag client-owned, vendored and licence-restricted code. Run a secret scan; we repeat it, but it helps to know early. Nominate one engineering lead as technical contact.
Software Product Companies:
common questions.
Straight answers for engineering leaders.
Does the code itself leave our control?
Only the repositories, time range and scope you approve. Delivery terms, permitted uses and any restrictions on redistribution are set in the agreement before anything is prepared.
We build software for clients. Can we include that work?
Only where your contracts give you the right to. Client-owned code is excluded unless the client agrees. We help map which repositories are yours to offer.
Could this expose our product roadmap or a competitive advantage?
You choose the scope, and we can exclude repositories, paths or periods. Removing names alone cannot prevent every possible disclosure, so we agree recipients and uses up front.
Our history contains secrets that leaked years ago. Does that rule us out?
Not necessarily. We scan the full history and remove what we find from the prepared output; you should rotate anything exposed. A repository that cannot be cleaned reliably may be left out.
Is open-source code inside our repositories a problem?
Third-party code is checked against its licence and is usually excluded. Your own code around it may still be in scope.
Find out what your engineering history could be worth.
Start with a short company assessment.