Codebase read
We clone the repo, run the build, and read the paths that matter. The most-changed files, the code your team avoids, and the parts that slow onboarding come first.
An honest second opinion on your stack.
A two-week read of your codebase, infrastructure, and team — or a target’s, before you invest or acquire. Prioritized findings with effort and risk on each.
What we read
Four surfaces, two weeks, one ranked list.
Structured passes across code, infrastructure, security, and team. Each finding is written so someone can act on it Monday.
Infrastructure and cost
Cloud spend, CI/CD, observability, and infrastructure-as-code. Does the platform support the team’s pace, and what will it cost at 10× load?
CloudCI/CDSpend
Security posture
Identity and access, secrets handling, dependency hygiene, and data exposure. Read against the threats your business faces.
IAMSecretsDependencies
Team and delivery
Review throughput, release cadence, incident response, and key-person risk. We read the artifacts and interview the people.
CadenceOn-callKey-person
Red-flag report for deals
For investors and acquirers: the issues that change price, terms, or the 100-day plan. Ranked, evidenced, and written for a deal team.
Remediation cost estimates
Every material finding carries an effort range in engineering days. Add them up and you have a remediation budget, not a worry list.
The hard part
Findings sorted by effort × impact, not severity tags.
Reviews that tag everything critical leave teams stuck. We rank instead. Your team gets one ordered list to work down until the budget runs out.
- Each finding sized in engineering days, as a range.
- Each scored on impact against the goals agreed at kickoff.
- Confidence stated plainly — low-confidence items get a follow-up check, not a rewrite.
- Every finding has a what, a why, and a how. One paragraph each.
Technical due diligence
Know what you’re buying before you sign.
Investors and acquirers get the same read, on a deal timeline. We work under NDA with your deal team, coordinate access with the target, and report to whoever commissioned the work.
- Scalability: what breaks first at 10× users, data, or team size.
- Security and data handling: exposure, access control, and incident history.
- Team: key-person risk, seniority mix, and how work ships.
- Open-source licences and third-party dependencies that affect IP.
- Remediation cost ranges your model and 100-day plan can use.
2 wk
Kickoff to written findings and a live read-out
Read-only
Access we ask for: repos, cloud console, dashboards
3 fields
Effort, impact, and risk on every finding
NDA
Signed before we see a line of code
The red-flag list moved two terms in the deal. The remediation ranges went straight into our 100-day plan.
Questions
What buyers ask us first.
Can you review a company we’re about to invest in or acquire?
Yes. We work under NDA with your deal team and coordinate access with the target’s technical lead. The report goes to whoever commissioned it, on the deal’s timeline.
How much of our team’s time does it take?
A kickoff walkthrough and about an hour of interview time per senior engineer. The rest is us reading code, configs, and dashboards.
What access do you need?
Read-only access to repositories, the cloud console, CI, and observability tools. We never ask for write access to production.
Will you fix what you find?
If you want us to. The report stands on its own, written so your team or any vendor can act on it.
How is it priced?
A fixed fee for the two-week review, quoted after a scoping call. Due diligence is scoped to the deal’s dates and the size of the target.
Ready when you are
Tell us what’s keeping the CTO — or the deal team — up.
A 30-minute call. You leave knowing whether a review fits, and what it would cover.