Five to eight agreed seller claims, each answered with its evidence and the exact limits of the check, targeted for five business days after complete access and inputs.
| Id | Seller claim | Status | Basis |
|---|---|---|---|
| C1 | All production code for the service lives in this repository | unverified | single_repository |
| C2 | CI runs the full test suite on every push | supported | tests_in_ci |
| C3 | The codebase has an automated test suite | supported | tests_present |
| C4 | No credentials or secrets are committed to the repository | partially supported | no_committed_secrets |
| C5 | The service runs on a supported Node.js LTS release | unverified | runtime_supported |
| C6 | Deployment is fully automated from the repository | unverified | deployment_as_code |
| C7 | Dependencies are locked for reproducible installs | supported | dependencies_locked |
| C8 | Two engineers actively maintain the codebase | unverified | active_contributors:2 |
| C9 | The code is MIT licensed | partially supported | license:MIT |
| C10 | Deployment and operations are documented | unverified | documentation:deployment |
| C11 | No customer data is stored in the repository | unverified | reviewer, pending |
| C12 | Test coverage is above 70 percent | unverified | coverage_measured |
Candor / Technical diligence report
Technical diligence:
bulletproof-nodejs
Draft · not approved
The service runs on a supported Node.js LTS release
UnverifiedRepository evidence points against the claim: the repository's declared runtime is past end of life: node 10.15 (EOL 2021-04-30). The runtime in production is not established by the repository.
Most technical diligence ends in a report nobody can check. Ours is built the other way round: every finding points at its evidence, every seller claim keeps the exact words the seller used, and whatever the code cannot settle is left unverified and named, with what would settle it.
Each runs against the snapshot of the repository and records what it inspected and what it cannot see. A check never settles a claim on its own: the reviewer reads the evidence and decides, under their name. These are the checks as the engine registers them.
ci_configuredA CI configuration for a recognised provider exists in the repository.tests_presentThe repository contains test files.tests_in_ciA step in a CI pipeline runs a recognised test command.coverage_measuredCoverage tooling is configured in the repository.dependencies_lockedEvery production dependency manifest has its lockfile committed.dependency_updates_automatedA Dependabot or Renovate configuration exists in the repository.no_committed_secretsNo known token format or credential assignment in production or configuration files.runtime_supportedDeclared runtimes and pinned images are within vendor support.containerizedA Dockerfile exists in the repository.deployment_as_codeDeployment or infrastructure is defined in the repository.recent_activityThe repository received commits in the last 90 days.active_contributorsAt least N people committed in the last 365 days.licenseThe root licence file matches the stated SPDX identifier.documentationThe README covers the named topic (installation, usage, development, testing, deployment, architecture, operations).single_repositoryCannot be supported statically; submodules or references to other repositories contradict it.no_copyleft_dependenciesCannot be supported statically; a copyleft root licence contradicts it.Each agreed claim gets an assessment, the evidence behind it, and the exact limits of the check; what the evidence cannot settle stays unverified and says what would settle it. Two of the twelve illustrative claims from the sample report, reproduced unedited.
C9 · CIM, p. 3
The licence file is MIT, but a manifest declares ISC.
documentation_filelicense: LICENSE, MITOpen in the report, observation b4cde7c175a19c1ca72f722c60b11db1documentation_coveragepresent: README, LICENSE; 0 doc files, 0 ADRsOpen in the report, observation 2b188245d083fbbd46350285765e7631C2 · CIM, p. 14
.circleci/config.yml runs `npm test`.
ci_pipelineCircleCI .circleci/config.yml: 1 jobs, 4 stepsOpen in the report, observation 4d6bffdb881ef084eb3e85a80f4f8439test_infrastructure1 test files vs 28 source files (ratio 0.04); frameworks: JestOpen in the report, observation 03e7c582a6ffbcd17ea38cacc1cb6d8dA typed fact the tool read from the repository, with its file, line and content hash.
51 in the sampleWhat a person read by hand, recorded the same way: file, lines, content hash, name.
verifier observeA judgement that cites observation ids. A claim keeps the exact proposition the seller made.
9 findings · 12 claimsThe reviewer accepts, dismisses or overrides each one, under their name, at the snapshot.
verifier reviewA hash of the whole report, including who approved it and when; re-verified on request.
verifier finalizeTwo pages. What held up, what did not, what to ask for in the agreement, and what a new team needs to run the software.
Five to eight seller claims we agree with you at intake, each assessed with the evidence, the scope of the check, and what would settle anything left unverified.
Findings, an explicit coverage statement and a full evidence appendix. The approval is recorded under the reviewer's name with a hash of the exact content.
Forty-five minutes with the seller's technical lead, then a call with whoever you want in the room.
The second column is the part most technical diligence leaves out. You should know where the floor is before you buy the work.
Findings and claim assessments cite observation identifiers that exist in the appendix, with the source references used to make them. Aggregates, external evidence and what a reviewer read by hand are identified as such, so you can see what each statement rests on.
If a file could not be read or a configuration could not be parsed, the report says so and marks the assessment partial, and the reviewer must acknowledge that before approving. A low rating does not establish low risk in what was not inspected.
A final report records the reviewer's name, a hash of the report's content and a hash of the analysed code, and the tool re-verifies that record on request. You receive the report data with the document, so the check can be repeated. Exported copies are static.
Static analysis reads the repository; it does not build or run the software. Build and test execution happens only with your written authorisation and the seller's consent, in an isolated environment. Reports minimize sensitive data and apply automatic redaction; review is still required before external sharing.
$2,500
Fixed, per engagement, invoiced on delivery of the readout. The fee covers one service and five to eight agreed claims; anything beyond that is agreed in writing before the work starts.
Read access to the code, the seller's claims as they were made, confirmation that you may grant us access, and one forty-five minute slot with their technical lead. The five days start when all of it is in hand.
One small service: a repository, or a small group of them, named at intake. Larger estates are quoted separately after we have seen the shape of them.
One engagement at a time, so the reviewer who reads your report is the same person on the readout call.
Send the deal size, the stack, and when your exclusivity window closes. We reply within one business day, Pacific time, to say whether it fits.