Due diligence

Required

• Build the product from the company's own repository

  TKO-27

  Before signing, build and run the product from the company's own repository with read-only access, without help from the founders or the AI builder.

• Scan the whole history for secrets

  TKO-31

  Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing.

• Test the access rules on the running product

  TKO-32

  With two test accounts in the running product, try to read and change the other account's records on every route. Check that no secret key ships to the browser and that payments are confirmed on the server.

Recommended

• Find every part that depends on one person or one tool

  TKO-28

  For each critical area, record how many people can change it and which outside tools it cannot run without. Name every area with fewer than two people.

• List the licences of the code and every dependency

  TKO-29

  Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.

• Ask the team to explain the critical paths without AI

  TKO-30

  Ask a team member to walk through payments, sign-in, permissions and data deletion in the code, without an AI tool. Record whether the explanation matched the code.

• Check how the team reviews AI-written code

  TKO-33

  Sample the last 50 changes merged to the main branch. Record how many had a passing check run and a review by someone other than the author.

• Measure cost per customer over the last 12 months

  TKO-34

  Work out the monthly cost of hosting, the database, AI models and other usage-priced services per active customer, for each of the last 12 months.

• List what must be rebuilt to grow

  TKO-35

  List every part that must be rebuilt to reach the buyer's growth plan. Give each an effort range and the load or date when it is needed.

• Check how personal data is handled

  TKO-36

  Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store.

• Tie every finding to a rule ID and evidence

  TKO-37

  Give every finding in a due diligence report the rule ID it breaks, a severity, the evidence and a fix estimate.

• Never sign a review of code you have changed

  TKO-38

  The person who signs a due diligence report has made no change to the code under review.

• Work from read-only access and delete copies afterwards

  TKO-39

  Review the target's code and systems with read-only access, and paste no code into outside AI tools without written permission. Delete every copy within 14 days of delivering the report.