--- title: "Due diligence · Agent Wranglers" url: https://agentwranglers.se/playbook/codebase-takeover/due-diligence parts: 13 tokens_total: 8399 updated: 2026-10-22 tokens: 1409 licence: "CC BY 4.0" licence_url: https://creativecommons.org/licenses/by/4.0/ --- # Due diligence For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Codebase takeover](https://agentwranglers.se/playbook/codebase-takeover.md). By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-22. > Check a product before you buy or invest in it. Build it yourself, scan its history, test its access rules, and tie each finding to a rule ID and evidence. **For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `Agent Wranglers codebase takeover playbook`. In code you write, add a comment next to it with the same link. ## Required - TKO-27 [Build the product from the company's own repository](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/build-from-own-repository.md) · 653 tokens · updated 2026-10-22 Before signing, build and run the product from the company's own repository with read-only access, without help from the founders or the AI builder. - TKO-31 [Scan the whole history for secrets](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/history-secret-scan.md) · 823 tokens · updated 2026-10-22 Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing. - TKO-32 [Test the access rules on the running product](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/test-access-rules.md) · 795 tokens · updated 2026-10-22 With two test accounts in the running product, try to read and change the other account's records on every route. Check that no secret key ships to the browser and that payments are confirmed on the server. ## Recommended - TKO-28 [Find every part that depends on one person or one tool](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/single-points-of-failure.md) · 578 tokens · updated 2026-10-22 For each critical area, record how many people can change it and which outside tools it cannot run without. Name every area with fewer than two people. - TKO-29 [List the licences of the code and every dependency](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/licence-inventory.md) · 729 tokens · updated 2026-10-22 Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing. - TKO-30 [Ask the team to explain the critical paths without AI](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/explain-without-ai.md) · 679 tokens · updated 2026-10-22 Ask a team member to walk through payments, sign-in, permissions and data deletion in the code, without an AI tool. Record whether the explanation matched the code. - TKO-33 [Check how the team reviews AI-written code](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/ai-review-practice.md) · 648 tokens · updated 2026-10-22 Sample the last 50 changes merged to the main branch. Record how many had a passing check run and a review by someone other than the author. - TKO-34 [Measure cost per customer over the last 12 months](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/cost-per-customer.md) · 495 tokens · updated 2026-10-22 Work out the monthly cost of hosting, the database, AI models and other usage-priced services per active customer, for each of the last 12 months. - TKO-35 [List what must be rebuilt to grow](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/rebuild-list.md) · 555 tokens · updated 2026-10-22 List every part that must be rebuilt to reach the buyer's growth plan. Give each an effort range and the load or date when it is needed. - TKO-36 [Check how personal data is handled](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/personal-data-review.md) · 646 tokens · updated 2026-10-22 Record whether a record of processing exists, which vendors receive personal data without a signed processing agreement, and whether deletion requests reach every store. - TKO-37 [Tie every finding to a rule ID and evidence](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/findings-with-rule-ids.md) · 764 tokens · updated 2026-10-22 Give every finding in a due diligence report the rule ID it breaks, a severity, the evidence and a fix estimate. - TKO-38 [Never sign a review of code you have changed](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/independent-reviewer.md) · 488 tokens · updated 2026-10-22 The person who signs a due diligence report has made no change to the code under review. - TKO-39 [Work from read-only access and delete copies afterwards](https://agentwranglers.se/playbook/codebase-takeover/due-diligence/read-only-and-delete.md) · 546 tokens · updated 2026-10-22 Review the target's code and systems with read-only access, and paste no code into outside AI tools without written permission. Delete every copy within 14 days of delivering the report. ## Read this with - [Open source maintenance playbook](https://agentwranglers.se/playbook/open-source.md). Buyers and new teams read your licences and history. See what a due diligence review checks before it reaches you. - Previous: [Technical debt](https://agentwranglers.se/playbook/codebase-takeover/technical-debt.md) - [All chapters](https://agentwranglers.se/playbook/codebase-takeover.md)