Your own source (self-hosted)

A self-hosted deployment can cite findings against your own source tree, not only the published platform source. A line your team changed is then cited as the code your devices actually run. Everything on Source-grounded findings applies: the version a log states still has to match the tree exactly.

Where it is built

Your administrator points the deployment at the tree once. The index, and the copy of your source it cites, are built inside your deployment and encrypted under a key that exists only there, and none of your source is sent anywhere to build them. Until your administrator assigns the index to your organization, it cites nothing for anyone.

Once it is assigned, your captures are cited against your tree rather than the published source at the same release, and other organizations never see it. A capture is matched to a source tree when it is uploaded, so a capture uploaded before the assignment keeps citing the published source. Upload it again to have it cited against your tree.

That key is kept out of your deployment’s backups. A backup of your deployment’s storage can hold the encrypted index and source copy, but not the key, so no backup copy can open them. If the deployment is ever restored from a backup, your administrator creates a new key and rebuilds the index from your tree; until then, citations from your own source are unavailable and everything else keeps working.

Rebuilding

After the tree changes, a rebuild is one command, and the new index replaces the old one without a restart or an upgrade. Your administrator can also schedule it. A rebuild started while another rebuild of the same index is running is refused, so avoid starting two at the same moment.

Before a rebuild is used, the deployment analyzes a reference capture you choose against the current index and against the new one, and holds the rebuild back if fewer of that capture’s lines would be cited. Pick a capture that exercises the code you care about. Your administrator can override the hold when the drop is expected, for example after deleting a subsystem; an override states its reason and lapses on a date they set.

Captures already analyzed keep the citations they were given, and are marked Source updated since. Citations are resolved when a capture is uploaded, so upload the capture again to cite it against the rebuilt index.