Here is every check a screen runs on the code you're buying, and what each one tells you. Seven analyzers give the same findings for the same repository at the same revision, every run, sealed so you can prove it. What isn't built yet is on this page too, labeled the way your memo labels what it didn't assess.
This deal cycle turns on one question: is the AI in the deck in the code? Assay reads the target's own words in the repo, from the README to the marketing copy, pulls out every AI claim, and then searches the codebase for what would make each one true: model SDK imports, named model identifiers, inference calls, embedding and prompt pipelines.
"AI-powered", "machine learning", "our proprietary model": each claim is captured with its file and line, so the memo quotes the target's own words back with a citation.
SDK imports, model IDs, inference and embedding calls across the source tree. A live claim with nothing in production code behind it is a critical finding.
An integration that exists only in test files is its own high-severity finding, because that is where a demo-ware "AI integration" hides. A test mock never counts as proof.
A static scan proves the code talks to a model. It can't prove the revenue runs through it. So these findings carry a capped confidence, and the $25–35k tier adds a human demo-tracing session to answer the rest.
The commit history knows who built the system. Assay reads every commit for the truck factor, the share held by the dominant author, and the significant files only one person has changed, counted from the code rather than from an org chart the seller drew last week.
How many people can leave before the codebase is unmaintainable? A truck factor of 1 on the core is a high-severity finding with the files named.
Author share per significant file. The thresholds are tuned per deal, because a 4-person startup is not a 400-developer monorepo.
Buyers already deduct for this: key-person risk drives a 0.5–1.5x multiple reduction in current buyer frameworks. Assay gives you the evidence to negotiate it.
Copyleft in a proprietary target changes what you're buying. Assay finds AGPL, GPL and LGPL signals in license files, SPDX headers and manifest declarations, and grades by the worst family present. AGPL outranks GPL. A license string in a test fixture is annotated and downgraded, and never raises a red flag on its own.
Cloud keys, private-key blocks and tokens committed to the repository. Every hit is redacted in the memo, so you learn what leaked without the memo leaking it again. Each one is classified by rule and by location, so a live production credential never gets mistaken for a test fixture.
A buyer can get lint scores and coverage percentages free. So this analyzer measures only what a pass that never executes the code can establish, and the finding says so: Assay never runs a target's test suite, so it reports whether tests exist and leaves their coverage to whoever runs them.
Whether a test suite and a CI configuration exist at all. With no CI on a live codebase, changes are checked by hand or not at all, and the finding flags that as an integration cost.
The files that change constantly and are written almost entirely by one person. That overlap is where knowledge concentration bites after close, and neither churn nor bus factor sees it alone.
Severity is capped so a commoditized signal can never outrank a real liability in the deal recommendation. Missing tests should never outvote a leaked production credential.
A report that can't say which revision it examined can't be re-run, checked or defended in an investment committee a month later. Every Assay run carries the target's commit SHA and a cryptographic seal.
Each finding is hashed over its own content; the run seal covers the ordered findings plus the revision. Re-running at the same revision reproduces the seals byte-for-byte, and an altered memo fails to.
Diligence is a snapshot, and the target keeps committing between LOI and close. Re-screen and see what changed: new findings, severity moves, metric drift. A signal that disappears is reported as no longer detected, and you decide whether it was fixed.
Each metric is placed against earlier screens of targets the same size. Until 20 comparable screens exist, the benchmark reports itself as not assessed, because a metric with nothing to compare against is unknown.
Two-thirds of audited codebases now carry open-source license conflicts, up from 56% a year ago, and the average codebase carries 581 known vulnerabilities (OSSRA, 2026). Both arrive through the dependency tree, which is why a scan of the target's own files answers neither question.
Lockfiles in eleven formats across seven languages, npm to Cargo, parsed offline with no install and no registry call. Copyleft that arrives transitively is the majority case, and a review of direct dependencies misses it. The obligation attaches to what ships, whoever chose it.
The document counsel and reps-and-warranties underwriters ask for by name. It carries no timestamp, so the same revision always produces the same file. A dependency whose license can't be resolved is reported as unresolved and treated as unknown.
The vulnerability database is a file stamped with the date it was built, and it runs on the seller's machine with everything else. The memo cites that date, so you can see how fresh it is. With no snapshot supplied, vulnerabilities are reported as not assessed, which is a different answer from none found.
A match means the vulnerable code is present. Whether it can be exploited inside the target's product is a question for its engineers, and the finding says so instead of inflating a count into a crisis.
Assay has no cloud credentials and never will. What it can read is the target's own infrastructure-as-code, which is where no backups, open to the internet and one replica are written down in plain text.
Public databases, ingress from 0.0.0.0/0, public object ACLs, and managed databases with no declared backup retention. Egress to anywhere is deliberately not flagged, because it's normal and noise costs trust.
Single replicas, single-AZ databases, workloads with no resource limits, privileged containers, and base images pinned past their upstream support window, checked against a dated table the memo prints and asks you to confirm.
These files record what someone intended to deploy. They may be stale or overridden in a console Assay can't see, so every finding says so and none can reach CRITICAL. A target with no IaC in the repo is a gap: many teams provision by hand, and the memo marks that as unknown.
Findings converted to engineer-days and priced at a blended rate you replace with your own. Every output is a range, with the assumption table printed beside it. An unsubstantiated AI claim is left unpriced on purpose, because it belongs in the deal terms and no sprint fixes it.
Fan-in, module size, cross-directory coupling and what the entry points never reach, plus the questions that shape raises. Assay measures the shape and refuses to grade the architecture, because a synthesized "won't scale" is the confident, unfalsifiable sentence this engine exists to avoid.
Every finding generates a question for management, carrying that finding's seal. Answers are recorded against it — who said it, when, what evidence they offered. Edit the finding afterwards and the answer visibly detaches instead of silently re-attaching. Assay records answers; it does not verify them.
Until an analyzer ships, its category appears in every memo as not assessed, listed with the gaps. Here is what the bench holds:
Who contributed, under what agreement, and whether the chain of title behind the IP representation holds, read from the same git graph the key-person analyzer uses.
Value-path reachability and the architecture pack read JavaScript and TypeScript today. Python, Go and Java targets get the rest of the battery, and an explicit gap for this.
SOC 2, penetration tests, IAM and data handling live outside a codebase. Assay won't synthesize them from source. They belong to the reviewer and the management session, and the memo says so.
Book a screen and read it in your own memo, gaps included.
Book a Screen