Technical due diligence
Technical due diligence: do you know what is in the code?
In an acquisition, an investment or a handover from an agency, what counts is what is in the source code. Our code audit delivers proven findings on security, dependencies and code quality, at a fixed price and within a few business days.
We deliver the code part of a technical due diligence, not a complete due diligence and not a penetration test.
Three typical occasions
Acquisition or investment
You are assessing a target company and want to know which risks and legacy issues sit in the product. The target company grants access to the code.
Preparing a sale
You have your code reviewed in advance, fix the main points and go into talks with a report.
Handover from an agency or developer
You are taking over an application and want to know its condition before acceptance.
What the code part covers and what it does not
We deliver the code part of a technical due diligence. The other parts stay with your advisers.
Covers
- Security: vulnerabilities per OWASP Top 10:2025, secrets in the code
- Dependencies: known CVEs, outdated frameworks and runtimes
- Code quality: structure, complexity, duplication, tests
- Technical debt: build and CI configuration in the repository, supply chain
Does not cover
- Team, organisation and development processes
- Intellectual property rights and open-source licences
- Finances, contracts and valuation
- Manual penetration tests
What the report contains
- Every finding with its location and a CVSS 3.1 and CWE rating
- Technical debt at a glance: code quality, complexity, tests, build and dependencies
- Prioritised action plan: now, next sprint, backlog
- Raw data from every tool in the appendix
How we review: Methodology
Confidentiality
- NDA first, plus a DPA if the code contains personal data
- Read-only: we run nothing, install nothing and push nothing
- Code uploads are kept in private storage in the EU
- Analysis with Claude by Anthropic (USA), based on the EU Standard Contractual Clauses
- The AI provider does not train on your code
- Deletion after completion, periods in the privacy policy
- Report handed over encrypted
Time and price
Code audit · €890
Source code, dependencies and code quality. Report in 2 business days.
Full audit · €1,690
Adds the running application with test accounts, every finding reviewed by an expert. Report in 4 business days.
Enterprise · on request
Several applications or a whole portfolio, planned individually.
Fixed prices, net, for applications up to about 300,000 lines of code; for larger ones we quote the price upfront. With Express you receive the code or full audit report within 24 hours on business days. Details: code audit, full audit, Enterprise.
NIS2 and evidence for customers
The report documents method, scope, findings and measures. It can serve as a building block for evidence towards customers, investors and auditors. It does not replace a certification or a conformity assessment. What the Cyber Resilience Act means for manufacturers: Cyber Resilience Act reporting duties.
Frequently asked questions
Does this replace a full technical due diligence?
No. We deliver the code part: security, dependencies, code quality and technical debt. We do not assess team, processes, intellectual property rights or finances.
Can the seller commission the audit?
Yes. As a seller you can have your code reviewed in advance, fix the main findings and take the report into the talks. The report describes the code as handed over (with commit or checksum) at the time of the audit. It is addressed to you as the client and is not a warranty to buyers or investors.
How do you get access to the code?
As an encrypted archive or via read access to the repository (GitHub, GitLab, Azure DevOps, Bitbucket). You can revoke access at any time.
How fast is the report?
The code audit in 2, the full audit in 4 business days after payment and complete handover. With Express within 24 hours on business days.
Is the report suitable as evidence for NIS2 or customers?
It can serve as one building block. It documents method, scope, findings and measures. It does not replace a certification or conformity assessment, and whether it is sufficient for your obligations depends on your overall approach.
Do you sign an NDA?
Yes. We sign the NDA before we see any code, plus a DPA if the code contains personal data.
Before you sign? Review the code first.
All prices net, plus VAT. Businesses only. Our terms and conditions apply.