Technical Due Diligence: What We Find Every Time

Technical due diligence before acquisition or investment reveals the same eight issues in nearly every codebase. These signals determine whether the technology is an asset or a liability. A structured 1-2 week assessment surfaces red flags early.

Eight Signals to Check

Test coverage and quality. Below 60% coverage with no integration tests means hidden bugs. Look for flaky tests and missing edge cases.

Dependency staleness. Outdated frameworks with known CVEs or major version lags signal maintenance debt. Check npm/pip audit and GitHub Dependabot history.

Deployment automation. Manual deploys or brittle scripts indicate operational risk. CI/CD with blue-green or canary patterns is the baseline.

Database migrations. Ad-hoc schema changes or missing migration history create data integrity risks. Require reversible migrations and rollback testing.

Secrets management. Hardcoded credentials or .env files in git are immediate blockers. Require HashiCorp Vault, AWS Secrets Manager, or equivalent.

Monitoring and alerting. No structured logging, no dashboards, no on-call rotation means blind operations. Look for Prometheus, Datadog, or CloudWatch coverage.

Documentation. Missing architecture decision records and API specs slow onboarding and increase risk. ADR count and OpenAPI coverage are quick proxies.

Scalability bottlenecks. Monolithic design with shared database and no horizontal scaling path. Identify hot paths and projected growth.

Red vs Yellow Flags

Red flags: hardcoded secrets in prod, no backups, single point of failure with no failover, unknown license obligations. These kill deals or require heavy remediation.

Yellow flags: moderate tech debt, some manual processes, partial test coverage. These are negotiable with a remediation plan and budget.

Cost to Fix Estimates

Typical ranges: secrets migration $10-25k, test coverage to 80% $30-60k, CI/CD overhaul $15-40k, observability stack $20-50k. Factor these into valuation.

Internal links: see software rescue failing project and MVP rescue project rescue developer.

FAQ

How long does thorough due diligence take?

1-2 weeks for a focused assessment by experienced engineers. Larger codebases or complex domains may require 3 weeks.

Can we rely on the seller's self-assessment?

No. Sellers understate issues. Independent review is non-negotiable.

What if the team is small and documentation is light?

Focus on running code and production metrics. Operational evidence often reveals more than docs.

How do we prioritize fixes post-acquisition?

Rank by risk and blast radius. Security and data integrity first, then operational reliability, then developer velocity.

Is open source tooling sufficient for due diligence?

Yes for initial scan. Commercial tools (Snyk, SonarQube) add depth for compliance-heavy industries.

Have a project that needs this? Talk to Rutagon or call 907-841-8407.