hebel. today · 2 November 202650 / 69
Business · Tech Due Diligence
Audit AI-Built Code Before You Invest
Software investments now require evaluating the long-term viability of systems that your team may not fully comprehend. While AI tools reduce initial development costs, they often create comprehension debt, as developers who use AI…
From 5 newsletters · 1 min read · one thing to try
Software investments now require evaluating the long-term viability of systems that your team may not fully comprehend. While AI tools reduce initial development costs, they often create comprehension debt, as developers who use AI to write code score lower on knowledge tests than those who code by hand (The VC Corner). Maintenance costs frequently exceed expectations because AI-generated code is often verbose, containing more bugs and security issues than human-authored equivalents (The Agency Fund). When assessing a target, prioritize measuring technical health over simple output volume, as high pull request throughput often masks lower delivery stability.
Technical diligence must move beyond expensive, static audits toward automated, localized verification. You can run scripts locally to identify key-person risk by calculating the bus factor for major modules and scanning dependency trees for viral copyleft licenses (Morse Bridge Substack). This approach prevents sensitive deal data from leaving your environment while providing a clear picture of potential legal and operational exposure (Morse Bridge Substack). Before accepting a codebase as an asset, use AI to challenge the vendor's implementation by attempting to replicate core features independently (All Agents Considered). This reveals whether the software is truly functional or merely a collection of AI-generated files that lack structural integrity.
Scalability depends on whether the software is modular and configurable rather than hardcoded for specific initial use cases. A robust platform allows for data isolation and component reuse, enabling the vendor to ship improvements to all customers simultaneously. When companies build with AI without deep architecture, they often struggle with technical debt, security risks, and database upgrades they do not fully understand (NextPath Mag). Evaluate whether the target has transitioned to a multi-tenant model that supports configuration over customization, as this determines if the product can scale without requiring constant, expensive engineering intervention.
Try today · 30 min
Run a commit bus factor analysis on the target's codebase.
Use the prompt to identify modules dependent on a single contributor to assess key-person risk.
You need
- Target company's full git commit history
- An LLM terminal or local coding environment
Steps
- Export the full git commit history from the target repository.
- Identify major modules and directories within the codebase.
- Calculate the bus factor for each module by counting unique contributors.
- Flag modules owned by a single contributor with no recent co-commits.
- Cross-reference contributors with zero commits in the last 6 months.
- Rank the modules by risk level from most to least exposed.
- Document the findings in a one-line explanation for each high-risk module.