Technical due diligence on the code, not the pitch

Findings grouped by area — quality, security, architecture, testing, documentation — each graded by severity, with the file it lives in and an estimate of what leaving it alone costs, and the three things worth fixing first. Then a call. We do not deliver three hundred lint warnings and call it diligence.

Not at the moment, and the reason is worth knowing. Our earlier audit bot gave every repository a score out of ten, and we used to quote the average for codebases we had not written. When we checked how that sample was built, it turned out to include code we had written ourselves, so we withdrew the number rather than keep quoting it. The agents we run now grade findings by severity instead of a single score; we will publish what they show once the sample cleanly separates code we inherited from code we wrote.

Reliable enough to run every week, and not reliable enough to sign a report on their own. Of 1,699 runs since March 2026, 144 failed — most of them on repositories too large for a single pass, which is now handled. That is why an engineer reads every report before you do, and why a run that read nothing is never counted as an audit.

Yes, and occasionally it is. The more common outcome is a middling read with two or three genuine risks, because that is what working software looks like after a few years of shipping. Saying so plainly is the point of paying someone without a stake in the deal.

We can build, so the conflict is real and worth naming rather than denying. Two things limit it: the report is written before any remediation is scoped, and you can buy the audit as the only deliverable and tell us so up front. It is also a perfectly good outcome to hand our report to your own team or to another vendor — that happens, and the report is written to be usable that way.

A week for one codebase, two for a large or multi-service estate. Diligence windows are usually shorter than anyone wants, so say the date on the first call — if the timetable is not real we will say so then rather than deliver a thin read on the day it is due.

We are not a regulatory consultancy and we do not issue formal security certifications. We have not taken a product through FDA clearance. If your diligence needs a penetration test with a signed attestation, or a SOC 2 audit, hire the specialists who do only that — our read covers the code, the architecture and what it will cost to own.