Technical diligence has a documented complaint against it: it's "opinion with a logo on it." Assay works under five rules that live in its code rather than in a style guide. A finding that breaks one never reaches your memo. Here is each rule, and what it means for your deal.
A finding can cite only something your engineer can open: matched lines, file paths, commit statistics, manifest entries. The rule doesn't depend on a reviewer staying careful through a busy week, because the code throws an error before it will assert a risk with no source. An empty citation stops the run.
A check that didn't run appears in the memo as not assessed — UNKNOWN, not clean. Most diligence reports imply safety for everything they didn't look at. The gaps section is there so yours can't: what Assay didn't examine sits beside what it found, at the same size.
Each finding carries a confidence between 0 and 1. Authorship statistics are strong evidence of who holds the knowledge, but they can't prove that person still works there, so that finding ships at 80% and says why. Your team can weigh a strong signal differently from a suggestive one, because the memo tells them apart.
The deal recommendation follows from the worst severity found: critical → RED-FLAG, high → DILIGENCE-REQUIRED, medium → PROCEED-WITH-CONDITIONS. A memo with no findings at all reads INSUFFICIENT-DATA, because an empty memo proves nothing. Nobody's mood is in the loop, and the same repository grades the same way twice.
Nothing to install, no network calls, no clock, no randomness. Apart from reading the git history, the engine touches nothing outside itself. So every memo can be reproduced when someone challenges it, and the screen can run on the seller's own machine. Sellers hate shipping source to a stranger's cloud, and with Assay they never have to.
Take one example. A dummy AWS key in a target's test suite is still reported, because a "fixture" can be a real leaked secret. It's marked as a test path and stops driving severity. Nothing is suppressed or inflated, and the same rule stops a mocked SDK in a test file from counting as proof that the AI is real.
The recommendation frames a decision that stays yours. Assay informs a buyer and never decides an acquisition. The engine pulls out what can be checked, and a senior reviewer reads it against your deal thesis and tells you what it means, including when the honest answer is "this instrument can't see that."
Tell us about the target and when your LOI expires. If a screen isn't the right instrument, we'll say so.
Book a Screen