![CodeDD]

CodeDD — Technical Due Diligence Analyst

Turn any codebase into an investor-grade technical due diligence report — the audit a senior engineer normally charges $3,000–$8,000 and a week to produce, generated in minutes.

What is this

Before an investment, an acquisition, a vendor takeover, or inheriting a project from a departing team, someone always asks the same question: is the code actually okay? Getting a real answer usually means paying a senior engineer to spend several days reading an unfamiliar codebase.

CodeDD automates the groundwork of that review and writes it up as a structured, scored, decision-ready report — the same shape of document a fractional CTO hands to an investment committee. Point it at a repository and it reads the dependency manifests, scans for secrets, walks the git history, checks test/CI signals, and comes back with a weighted risk score, a red-flags summary, and a plain-language recommendation.

It is not a code review tool. It doesn't suggest variable names or nitpick style. It answers one question: should you proceed, and what would it cost you if you do.

How it works

![How CodeDD works]

1. Point it at a repo — a local path, an uploaded zip, or a git URL, public or private.
2. Automated static analysis runs in one pass — dependency inventory + vulnerability lookups against OSV.dev, a secrets/credentials scan, git history analysis (contributor concentration, commit velocity, churn hotspots), and hygiene checks (tests, CI, README, LICENSE, Dockerfile).
3. Findings are scored across 5 weighted dimensions into a single 0–100 risk score with a clear risk band.
4. You get a full report — every claim traceable to a specific file, dependency, or commit, not generic advice.

What a report looks like

![Sample scorecard]

Every report opens with the same structure: an overall score, a risk band, and a breakdown across the five dimensions that fed it — so the reader sees not just what the score is, but why.

![Red flags summary]

The red-flags section is where the report earns its keep. It doesn't just say "test coverage could be better" — it says 87% of commits are from one contributor, and there's no documentation to offset that risk, with the exact numbers behind it. Findings that check out cleanly are called out too, so the report reads as a fair assessment, not a hit piece.

What gets checked in every run

![Coverage]

Full methodology and scoring bands are documented in references/risk_rubric.md; the hard-red-flag conditions (committed secrets, single-author monoculture, gone-quiet projects, code-dump git history, etc.) are in references/redflags_checklist.md.

Why not just ask an AI to "look at this code"

A casual review gives you impressions. This gives you an instrument: the same weighted rubric applied every time, findings that cite a specific file or commit instead of a vibe, and an explicit "proceed / proceed with conditions / do not proceed without remediation" call — because that's the actual question a decision-maker is paying to have answered.

![Traditional vs CodeDD]

Who runs this

![Who runs CodeDD]

Quick start

# 1. Get a local copy of the target repo
git clone --depth 200 https://github.com/example/target-repo target_repo

# 2. Run the static analyzer
python3 scripts/analyze_repo.py target_repo --output analysis_output.json

# 3. Hand analysis_output.json to CodeDD (as a Claude/Codex/ChatGPT skill) —
#    it reads the JSON, spot-checks the flagged findings, and writes the
#    full report following references/report_template.md

No setup beyond Python 3's standard library — the analyzer has zero required dependencies. Network access (for the OSV.dev vulnerability lookup) is used if available and skipped gracefully if not; either way, the report says explicitly which checks ran and which didn't.

Report structure

Every delivered report follows the same outline: Executive Summary → Codebase Overview → Dependency & Supply Chain Risk → Security Posture → Code Quality & Testing → Team & Maintainability Risk → Technical Debt & Remediation Roadmap → Red Flags Summary → Recommendation → Appendix (raw metrics) → Limitations.

The full template is in references/report_template.md and is followed section-by-section, not treated as a loose suggestion.

Honest about its limits

This is static analysis of source code, dependency manifests, and git history as of a point in time. It does not assess runtime or production infrastructure security, live performance under load, the correctness of business logic, or legal ownership of the IP. Every report says so explicitly in its own Limitations section — a due diligence report that overstates its own certainty is worse than no report at all for someone making a real decision on it.

FAQ

Does it work on private repos? Yes, if you can provide local access (clone, zip, or an authenticated URL) — CodeDD never needs its own repo access, it works on what you hand it.

Which languages/ecosystems does it cover? Language/LOC breakdown and git analysis work on any codebase. Vulnerability lookups currently cover npm and PyPI directly; other ecosystems (Go, Ruby, Maven, Rust, PHP) are inventoried and flagged for manual verification rather than silently skipped.

Can I use this for my own team's codebase, not an external one? Yes — the same "outside, decision-making perspective" is useful before a big migration, an audit, or when a new tech lead is inheriting ownership of a system.

What if it flags something that turns out to be a false positive? The workflow requires spot-checking flagged findings against the actual files before they go in the report, and documents that check. False positives get called out as such, not silently dropped or silently trusted.