Technical Due Diligence
A signed codebase, security and infrastructure report in five business days at a fixed price, written for the buyer who has to decide, not for the engineer.
Who it is for
- Acquirers of small software companies who have signed a letter of intent and have an exclusivity clock running.
- Angel and seed deal leads who need a technical read on the codebase before the wire.
- Founders about to raise or sell who would rather find the problems before the buyer does.
What it covers
- Five axes, each rated with evidence down to file and line and a plain-language business impact: architecture, security, code quality and tests, infrastructure and operations, team and key-person risk.
- A dependency and license inventory with end-of-life and advisory checks.
- The three findings that most affect valuation, and a go, caution or stop recommendation with the conditions attached.
- A 30, 60 and 90 day remediation plan with engineer-day estimates you can use in the price negotiation.
- A 45-minute readout call with the person who signed the report.
Pricing
Three fixed prices. Pick by the size of the codebase and the deal, not by how worried you are.
Express
$3,500
5 business days
- One repository under about 50,000 lines.
- Deals under about $250,000.
- Executive summary, five-axis rating and findings with evidence.
Standard
$7,500
5 business days
- One product, up to three repositories.
- Full report: findings, dependency and license inventory, 30, 60 and 90 day plan.
- 45-minute readout call.
Deep
$12,500
5 business days
- Multiple repositories or a compliance-heavy target.
- Interviews with the engineers and a call with the deal lead.
- Two rounds of questions after delivery.
- Add-ons
- Seven days of post-report remediation questions by message and one call: $2,500.
The first two engagements are offered at the Express price for any tier in exchange for a named testimonial.
See the depth before you buy
A sample report on an anonymized software company, with the full 40-item checklist.
What the report is and is not
The report is an expert opinion on the state of the code, the infrastructure and the team as observed in the window of the engagement. It is not a warranty and it does not replace legal, financial or commercial diligence.
Where a finding is inferred rather than verified, the report says so. Where a dependency may have a known vulnerability, the report points to the advisory database rather than asserting an identifier.
How it works
Read-only repository access under a mutual NDA. Five business days from access to report. The price is fixed and agreed in writing before any work starts.
AI coding agents do the volume of reading. Nathan reviews every finding, decides every rating and signs the report, and the report says so.