Technical Due Diligence Report
Northwind Labs (sample)
Generated October 1, 2026
Replokit · read-only code scan
Executive summary
Overall technical risk
High
23 repositories (16 active) using 17 external services across 2 cloud platform(s) and 3 database engine(s). 3 AI model(s) in use.
| Security | High | 2 credential(s) committed to source control |
| Open-source licensing | High | 1 production dependencies under strong copyleft or non-OSS licences |
| Key-person risk | Medium | 25% of active repos depend mostly on one contributor |
| Maintenance | Medium | 2 archived/stale repo(s) still wired to live infrastructure; 26% of repos inactive for a year |
| Delivery practices | Low | 81% of active repos have CI/CD or managed deploys |
Technology stack & vendors
Cloud Platform
AWS (12), GCP (3)
Database
PostgreSQL (11), Redis (6), MongoDB (2)
AI / ML
OpenAI (4), Anthropic (2)
Hosting / Deploy
Vercel (6), Docker (8)
Payments
Stripe (3)
Auth / Identity
Auth0 (4)
Email / Comms
SendGrid (3), Twilio (2)
Monitoring
Sentry (7), Datadog (2)
CI / CD
GitHub Actions (13)
AI models: gpt-4o · OpenAI (3), gpt-4o-mini · OpenAI (2), claude-sonnet-4 · Anthropic (2)
Numbers in brackets are repositories using the service.
Security
- Committed credentials2 in 1 repo(s)
- Known-vulnerable dependencies6 package(s) in 4 repo(s)
| Repository | Credential type |
|---|---|
| data-pipeline | AWS access key |
| data-pipeline | Slack webhook |
| Repository | Vulnerable dependency |
|---|---|
| web-app | next@14.0.1 · 3 advisories: GHSA-… |
| api | jsonwebtoken@8.5.1 · 3 advisories: GHSA-… |
| api | axios@0.21.1 · 2 advisories: GHSA-… |
| admin | lodash@4.17.15 · 1 advisory: GHSA-… |
| ml-service | pillow@9.0.0 · 4 advisories: PYSEC-… |
| ml-service | requests@2.25.0 · 1 advisory: GHSA-… |
Credential values are never stored or shown; vulnerabilities come from the OSV database.
Open-source licensing
| Dependency | Licence | Type | Used in |
|---|---|---|---|
| pyqt5@5.15.9 | GPL-3.0-only | Strong copyleft | desktop-agent |
| @img/sharp-libvips@1.0.4 | LGPL-3.0-or-later | Weak copyleft | web-app, marketing-site |
| web-streams-polyfill@3.3.3 | MIT AND MPL-2.0 | Weak copyleft | web-app, api, admin |
Repositories' own licences: MIT (2), Apache-2.0 (1) · 13 active repo(s) without a licence file (typical for proprietary code)
Key-person risk
4 of 16 active repositories have a bus factor of 1 — a single contributor wrote most of the code.
| Repository | Top contributor's share | Contributors |
|---|---|---|
| pricing-engine | 94% | 2 |
| desktop-agent | 88% | 3 |
| ml-service | 79% | 4 |
| data-pipeline | 71% | 5 |
Based on commit counts only; no contributor identities are stored.
Maintenance & delivery
- Inactive for 12+ months6 of 23 repositories
- Archived4
- Forgotten repos still wired to live infrastructure2
- CI/CD coverage (active repos)81%
Estimated infrastructure spend
$1.4k – $6.2k/mo across 5 paid platform(s)
Potentially $120 – $900/mo tied to 2 forgotten or stale repo(s).
Directional estimate from the service footprint — not billing data.
Methodology & limitations
Generated by Replokit from a read-only scan of the repositories the owner connected. Services are detected deterministically from dependency manifests, environment-variable names, infrastructure-as-code and CI configuration. Vulnerabilities come from OSV.dev and licences from deps.dev for production npm and PyPI dependencies. Key-person risk uses each repository's commit distribution. Source code is not stored and is not sent to any AI model. Detection is automated and may miss services configured outside the code; this report supports, but does not replace, a full technical review.
