Code and ownership

Required

• Build the product from the company's own repository

  TDD-4

  Before signing, build and run the product from the company's own repository with read-only access, without help from the founders or the AI builder.

• Confirm the company owns the code

  TDD-5

  Match every person and firm that wrote code to a signed agreement that gives the company the rights to it. Report each author without one as a finding.

• Scan the whole history for secrets

  TDD-7

  Run a secret scanner over every commit and branch of the repository, and test which found secrets still work. Every working secret is revoked before closing.

Recommended

• List the licences of the code and every dependency

  TDD-6

  Produce a bill of materials with an SPDX licence identifier for every package, and assess each copyleft, unknown or missing licence in writing.

• Find every part that depends on one person or one tool

  TDD-8

  For each critical area, record how many people can change it and which outside tools it cannot run without. Name every area with fewer than two people.

• Ask the team to explain the critical paths without AI

  TDD-9

  Ask a team member to walk through payments, sign-in, permissions and data deletion in the code, without an AI tool. Record whether the explanation matched the code.

• Check how the team reviews AI-written code

  TDD-10

  Sample the last 50 changes merged to the main branch. Record how many had a passing check run and a review by someone other than the author.

• Run the tests yourself and read 90 days of pipeline history

  TDD-17

  Run the full test suite on a clean checkout and record the pass rate and line and branch coverage of the critical paths. From the last 90 days of pipeline runs, record the failure rate, the flaky rate and the median duration.