AI-Built Software Due Diligence
An independent assessment for investors, acquirers, and technology leaders evaluating software developed substantially with AI coding tools, autonomous agents, or app builders—often described as “vibe-coded” products. Understand security, maintainability, and the work required for independent operation.
The acquisition question
Available as focused assessment or comprehensive due diligence. The assessment follows the software and the evidence. AI use alone does not determine quality.
A working interface leaves important questions open: whether customer boundaries hold, billing remains correct under retries, data can be recovered, and future changes can be delivered safely. The review examines those boundaries and the dependencies behind them.
How the assessment works →AI-built and AI-powered
AI-built means developed using AI coding assistants, agents, or app builders. It may have no AI feature at runtime. AI-powered software uses models in production; model dependencies, data handling, and AI-specific application risks require an agreed additional scope.
Code inspection alone cannot reliably establish AI authorship or provenance. This assessment does not certify IP ownership, legal compliance, complete security, or absence of defects.
Review looks for inadequately verified generated implementations, fragile architecture, duplicated logic, missing regression safeguards, and hidden dependencies, rather than assuming these issues exist because AI was used.
Engagement options & indicative pricing
Assessments of software products and software engineering operations, including a defined technology workstream within a larger transaction.
These are indicative ranges, not unlimited fixed-price offers. A written proposal identifies the systems, review questions, evidence sample, interviews, verification depth, exclusions, deliverables, and fee. Company size alone does not determine price.
Delivery starts once sufficient agreed access and inputs are available. Complexity, evidence gaps, technical-owner availability, and specialist needs affect the schedule. Prices exclude VAT where applicable.
Each assessment is personally led by Andrey Shedko. Additional specialist work requires a separate scope and confirmation of availability. Comprehensive describes broader agreed coverage, not exhaustive testing of an entire technology estate.
AI-built software: a specialization available at either scope, using the same indicative ranges. AI-built describes development with AI coding tools; AI-powered describes a product using models at runtime.
Explore AI-Built Software Due Diligence →Assessment focus
Select an area to see what the review examines. Scope and authorized checks are agreed before work begins.
Trace tenant isolation, authorization, privileged access, and secret handling. Check that authentication is followed by appropriate ownership checks on critical operations.
Review payments, webhooks, background jobs, and error handling. Examine replay, partial failure, and reconciliation so a successful demonstration is supported by reliable business behavior.
Inspect system boundaries, duplicated logic, dependencies, migrations, tests, and build reproducibility. Assess whether another engineer can understand and extend the product safely.
Review deployments, monitoring, backups, queues, and storage. Identify what must be restored together and what evidence supports the claimed capacity and operating costs.
Map builder platforms, hosting, identity, billing, integrations, and data exports. Establish which accounts and assets the buyer needs to control and where portability or vendor terms require further review.
Assess documentation, operating responsibilities, and the knowledge needed to release, debug, and recover the service. Identify what a replacement operator must demonstrate before independent ownership is credible.
Your deliverable
Receive an executive conclusion, prioritized findings, supporting evidence, and explicit coverage limits. Recommendations distinguish what needs resolving before acquisition, what can be managed afterward, and what still requires investigation.
Where the evidence supports it, remediation is broken into engineering tasks with effort ranges, dependencies, and acceptance criteria. Builder lock-in, absent access, and unverified claims are recorded as limitations.
This is a technical due diligence engagement. Penetration testing, compliance certification, legal/IP opinions, and guaranteed detection of every defect are outside the standard assessment. Specialist follow-up is identified where needed.
Download AI-built service summary (Markdown) →
Explore the full technical due diligence scope →Before acquiring an AI-built product
Start with the stack, builder platform, acquisition stage, and timeline.