What gets checked
Six checks, each answering a question a buyer would otherwise have to take on trust.
Real development leaves a trail — hundreds of incremental commits across months, with the shape of actual work. A single bulk commit, or a history that starts fully-formed, indicates a fork, a purchase, or an import. Both are legitimate; neither should be presented as original work.
The defining fear when buying a pre-revenue asset. We fingerprint the codebase against known starter kits, templates, and public boilerplates. A match doesn’t disqualify an asset — but a buyer is entitled to know before they pay.
Copyleft dependencies buried three levels deep can make a codebase legally unsellable in a commercial context. We resolve the full dependency tree and flag anything whose licence conflicts with a change of ownership.
Known CVEs across the dependency tree, graded by severity, with a note on how far behind the project has drifted. Technical debt priced at diligence is cheaper than technical debt discovered post-close.
Coverage across core modules, presence of a test suite at all, and whether the architecture is comprehensible to a new owner. A product only its author can maintain carries a real discount.
What share of runtime paths depend on external APIs. A thin wrapper over someone else’s service is a legitimate business, but it is not the same asset as one carrying its own logic — and it feeds directly into the Commodity Risk figure on the ADR.
It confirms how the code was built, not whether the product is good. A clean report on a well-engineered thing nobody wants is still a clean report on a thing nobody wants — judgement on market, timing, and strategic fit remains yours.
Template detection is fingerprint-based, so it catches known boilerplates rather than every possible derivation. And a private repository can only be scanned with the seller’s consent — an unverified listing isn’t evidence of a problem, only an absence of evidence. We label it that way rather than implying otherwise.