Replokit
Sign inGet started
for fundraises, acquisitions, and board reviews

Technical due diligence, in minutes instead of weeks.

Connect GitHub and get a rated report on the risks investors and acquirers ask about — security, open-source licences, key-person dependency, maintenance, vendors, AI usage, and cost. Read straight from the code, ready to share.

Get the report — $99See a sample report
app.replokit.com/diligence
Real report output with sample data · open the full sample

What the report rates

Each area gets a Low, Medium, or High rating with the evidence behind it, plus an overall technical risk rating.

Security

Credentials committed to source control and dependencies with known vulnerabilities, by repository.

Open-source licensing

Production dependencies under strong copyleft (GPL, AGPL), weak copyleft (LGPL, MPL), or non-open-source licences, plus each repo's own licence.

Key-person risk

Active repositories where a single contributor wrote most of the code — measured from commit history, with no identities stored.

Maintenance

Repositories inactive for a year, archived repos still wired to live infrastructure, and how much of the codebase is actively worked on.

Delivery practices

How many active repositories ship through CI/CD pipelines or managed deploys.

Vendors, AI & cost

Every cloud, database, payment, auth, email, and AI provider in use, the AI models called, and an estimated monthly infrastructure spend.

From GitHub to a shareable report

  1. 01

    Connect GitHub (read-only)

    Install the Replokit GitHub App on the repositories in scope. Read-only Contents and Metadata access — nothing is ever written.

  2. 02

    Scan and review

    Replokit maps the stack and rates each risk area. Fix what you can before the data room opens; the report updates with every scan.

  3. 03

    Share or export

    Print a PDF, or send investors and acquirers a private link that expires on the date you choose. Revoke it any time and see how often it's opened.

For founders

Find the uncomfortable answers before an investor does. Rotate leaked keys, replace copyleft dependencies, and spread knowledge out of single-maintainer repos — then hand over a report that shows it.

For investors & acquirers

Ask the company to connect GitHub and share a Replokit report. You get a consistent, comparable technical picture across deals in minutes — without anyone sending you source code. Talk to us about reviewing several companies.

Questions

Who is this for?

Founders preparing for a fundraise or acquisition, investors and acquirers reviewing a target's technology, and boards that want an independent view of technical risk.

How does an investor or acquirer get a report on a company they're reviewing?

The company connects its GitHub to Replokit (read-only) and shares the report with you through a private link that expires. You see the report — never the source code.

What does it check?

Committed credentials, known-vulnerable dependencies (OSV), open-source licences of production dependencies (deps.dev), each repository's own licence, key-person risk from commit history, inactive and forgotten repositories, CI/CD coverage, the full vendor and AI-model inventory, and an estimated infrastructure spend.

Is our source code shared with anyone?

No. Replokit reads dependency and configuration files to detect services, stores only the derived findings, and never sends code to an AI model. Shared links show the report only.

How much does it cost?

$99 one-time per workspace, which unlocks the report, PDF export, and share links for 90 days. It's included on Scale and Enterprise plans.

Does it replace a full technical review?

It covers the parts of a technical review that can be measured from the code, in minutes instead of weeks, so expert time goes to architecture, team, and roadmap questions. It doesn't replace interviews or a code-quality review.

Walk into diligence prepared.

Connect GitHub, run a scan, and see your ratings before anyone else does.

Get started free