Technical due diligence red flags: serious vs cosmetic

Most lists of technical due diligence red flags are padded with findings that have never changed a deal: an old framework version, a missing wiki, tabs versus spaces energy. Meanwhile the findings that do change deals are few, specific, and share one property: they translate directly into money, time, or fragility that the deal model has not priced.

We rank every finding by that translation. Here are the red flags that survive it, the cosmetic ones that scare the wrong people, and how to decide what a given flag should do to the deal.

Technical due diligence red flags that change deals

Five, in roughly descending frequency across our engagements.

No tests and no review discipline, together. Either alone is survivable: strong review culture can carry thin tests for a while, and good tests tolerate casual review. Both absent means every change is a gamble and velocity claims are unverifiable. It also predicts the state of everything you cannot see.

Secrets in the repository. Credentials in code, in CI logs, in commit history from three years ago that nobody rotated. Beyond the direct exposure, it tells you security was nobody’s job, and that finding rarely travels alone.

One-person systems. The billing pipeline, the data model, the deployment process: if each critical piece resolves to the same name, you are not buying a product, you are buying a person with terms to negotiate. The mapping method is in our note on key person risk.

Fabricated or unverifiable metrics. Accuracy measured on training data, uptime numbers no monitoring system can reproduce, "95 percent automated" where the logs show a human in most loops. One knowingly inflated number is the worst flag on this list, because it reprices every other claim in the data room.

Debt on the critical path with no map. All real systems carry debt; that is not the flag. The flag is debt the team cannot describe, sitting under the exact features the growth plan depends on. Unknown debt cannot be priced, and unpriced debt lands on the buyer.

For AI products, add one: no evaluation practice. A team that changes prompts and models without measuring quality is shipping blind, and hand-testing does not survive the second prompt change. In an AI-priced deal we treat this as severe, not cosmetic.

Cosmetic findings that scare the wrong people

Some findings look alarming in a report and mean little in practice. Outdated framework versions, if patching is routine and nothing unmaintained sits on the security boundary. Monolithic architecture, which for most businesses is a cost advantage wearing an unfashionable jacket. Sparse documentation with a strong review culture, since the knowledge provably circulates. An ugly module the team openly calls ugly, because teams that know where their bodies are buried tend to know their system.

The tell is direction. A cosmetic finding is static: it costs what it costs. A real flag compounds: every month of growth makes it more expensive to fix and more likely to detonate.

Severity means money and time

A red flag list without a ranking is an anxiety generator. Every finding in our reports carries a severity that means something concrete: critical means stop, this changes the deal or its terms this week. High means priced remediation belongs in the model and the first hundred days. Medium means the integration plan should absorb it. Low means the new owner should know, nothing more.

The discipline this forces is useful in both directions. It stops a nervous committee from treating an old Django version as a crisis, and it stops a motivated deal team from averaging one critical finding away against ten clean scores.

Renegotiate or walk

Most red flags argue for repricing, not retreat. A one-person system becomes a retention package and an escrow. Known debt becomes a remediation budget and a price adjustment. A security hole becomes a closing condition with a deadline.

Walking is for the flags that break trust or break the thesis: metrics someone knew were false, exposure that makes the liability open-ended, or a platform that cannot carry the plan you are buying it for at any budget you would accept. In our experience the fabricated metric is the clearest walk signal of all, because diligence can price almost anything except a counterparty you cannot believe.

The hard part is not spotting these flags; it is being sure, inside a deal window, which ones you are looking at. That judgment is most of what you are paying for in an independent technical audit: findings ranked by severity, translated into money and time, so the only decisions left are the ones that belong to the investor.