The technical due diligence checklist for startups and investors

Technical due diligence used to mean reading a codebase and trusting a senior engineer's gut. With so much software now written by AI, the gut needs help. Roughly 84% of developers now use AI coding tools, yet close to 46% say they do not trust the output. Independent research keeps finding that around 45% of AI-generated code ships with a known security weakness. That changes what a careful diligence process should look for.

This checklist works from both sides. If you are a founder, it is what to prepare. If you are an investor or acquirer, it is what to ask for and how to read the answers.

1. Security and access control

• Is HTTPS enforced, with modern TLS and security headers?
• Does access control actually prevent one user from reaching another's data? Ask for evidence, not assurance.
• Are secrets kept out of the codebase and the client bundle?
• Are there known-vulnerable dependencies in the build today?

2. Reliability and recovery

• Is there a health check and monitoring, so failures are noticed quickly?
• Is there a tested backup and a real rollback path?
• What happens under load? Has anyone actually looked?

3. Provenance and process

• How much of the code was AI-generated, and was it reviewed?
• Is deployment reproducible, for example containerized, so what was tested is what runs?
• Is infrastructure described in code, so a reviewer can see changes before they happen?

4. The evidence question

The theme running through all of it is the same: ask for evidence, not claims. A founder saying access control is handled is a claim. A validation that checked it against the live app is evidence. The difference is the entire point of diligence.

For founders: prepare before you are asked

The fastest way to sail through technical diligence is to have the answers ready as evidence before anyone asks. Run a validation, fix what it finds, and walk in with a Passport that shows the work. It turns a nervous review into a short conversation.

For investors: standardize what you ask for

If you evaluate a lot of early-stage, AI-built companies, a shared, evidence-based signal saves you from re-deriving the same checklist for every deal. StackAttest's investor view lets a founder share a Passport, so you read a consistent, verified result instead of a bespoke slide.