Sample Report

This report was produced by the same pipeline paying customers receive, run against the public open-source repository louislam/uptime-kuma at commit a808c63fe93b on 2026-08-21.

It is framed as a hypothetical $300,000 acquisition scenario — the deal figures below are our tool's recommended negotiation posture under that assumption, not a claim about the project or its maintainers.

Audit Your Target Codebase →

Methodology: analysis of the master branch at the commit above. Dependency licenses: package.json direct dependencies. Secret patterns: risk-prioritized scan of 17 files in the current default-branch tree. Contributor concentration: all-time contributor commit counts via GitHub API. Analysis completed in 5.1s.

Executive Diligence Memo • Report ID: dil_4be9f4b5ba29

Self-hosted uptime monitoring platform (hypothetical acquisition)

Scope: 780 files scanned • Branch: master

Acquisition Risk TierHIGH (73/100)

Executive Summary

Technical due diligence audit for Self-hosted uptime monitoring platform (hypothetical acquisition) completed on 2026-08-21. Overall Risk Score: 73/100 (HIGH). Identified 1 copyleft license issue(s). Detected 1 exposed credential(s) in repository tree. Key-person bus factor evaluated at 16. Recommended deal protections: $17,000 price deduction and $0 escrow holdback.

Recommended Deal Negotiation Terms

Recommended Purchase Price Reduction

-$17,000

Sum of the price-adjustment recommendations in the negotiation points below.

Recommended Escrow Holdback

$0 (3-month holdback)

Derived from the key-person and remediation findings below.

License Contamination Credit1 copyleft (GPL/AGPL) package(s) require engineering hours to isolate or rewrite with permissive alternatives.-$12,000
Security Hygiene RemediationAPI credential patterns found in the repository tree must be rotated and scrubbed before funds release.$0 (Pre-Closing Condition)
Test Infrastructure DeficitSub-20% test coverage creates regression vulnerability during post-acquisition transition.-$5,000

1. Open-Source License Risk

MODERATE

Detected 1 copyleft package(s) requiring commercial review. 7 of 155 dependencies could not be classified (unrecognized or unresolved licenses) — manual review recommended.

@actions/githubMIT

Permissive standard open-source license with minimal commercial restriction.

@fortawesome/fontawesome-svg-coreMIT

Permissive standard open-source license with minimal commercial restriction.

@fortawesome/free-regular-svg-icons(CC-BY-4.0 AND MIT)

Unrecognized license string. Manual review recommended during diligence.

@fortawesome/free-solid-svg-icons(CC-BY-4.0 AND MIT)

Unrecognized license string. Manual review recommended during diligence.

@fortawesome/vue-fontawesomeMIT

Permissive standard open-source license with minimal commercial restriction.

@playwright/testApache-2.0

Permissive standard open-source license with minimal commercial restriction.

@popperjs/coreMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/hivemqMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/mariadbMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/mssqlserverMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/mysqlMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/oraclefreeMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/postgresqlMIT

Permissive standard open-source license with minimal commercial restriction.

@testcontainers/rabbitmqMIT

Permissive standard open-source license with minimal commercial restriction.

@types/bootstrapMIT

Permissive standard open-source license with minimal commercial restriction.

@types/nodeMIT

Permissive standard open-source license with minimal commercial restriction.

@types/web-pushMIT

Permissive standard open-source license with minimal commercial restriction.

@typescript-eslint/eslint-pluginMIT

Permissive standard open-source license with minimal commercial restriction.

@typescript-eslint/parserBSD-2-Clause

Permissive standard open-source license with minimal commercial restriction.

@vitejs/plugin-vueMIT

Permissive standard open-source license with minimal commercial restriction.

@vue/compiler-sfcMIT

Permissive standard open-source license with minimal commercial restriction.

@vuepic/vue-datepickerMIT

Permissive standard open-source license with minimal commercial restriction.

aedesMIT

Permissive standard open-source license with minimal commercial restriction.

bootstrapMIT

Permissive standard open-source license with minimal commercial restriction.

chart.jsMIT

Permissive standard open-source license with minimal commercial restriction.

chartjs-adapter-dayjs-4MIT

Permissive standard open-source license with minimal commercial restriction.

concurrentlyMIT

Permissive standard open-source license with minimal commercial restriction.

core-jsMIT

Permissive standard open-source license with minimal commercial restriction.

cronstrueMIT

Permissive standard open-source license with minimal commercial restriction.

cross-envMIT

Permissive standard open-source license with minimal commercial restriction.

dns2MIT

Permissive standard open-source license with minimal commercial restriction.

dompurify(MPL-2.0 OR Apache-2.0)

Permissive standard open-source license with minimal commercial restriction.

eslintMIT

Permissive standard open-source license with minimal commercial restriction.

eslint-config-prettierMIT

Permissive standard open-source license with minimal commercial restriction.

eslint-plugin-jsdocBSD-3-Clause

Permissive standard open-source license with minimal commercial restriction.

eslint-plugin-vueMIT

Permissive standard open-source license with minimal commercial restriction.

eslint-plugin-vue-scoped-cssMIT

Permissive standard open-source license with minimal commercial restriction.

favico.jsMIT

Permissive standard open-source license with minimal commercial restriction.

node-sshMIT

Permissive standard open-source license with minimal commercial restriction.

postcss-htmlMIT

Permissive standard open-source license with minimal commercial restriction.

postcss-rtlcssApache-2.0

Permissive standard open-source license with minimal commercial restriction.

postcss-scssMIT

Permissive standard open-source license with minimal commercial restriction.

prettierMIT

Permissive standard open-source license with minimal commercial restriction.

prismjsMIT

Permissive standard open-source license with minimal commercial restriction.

qrcodeMIT

Permissive standard open-source license with minimal commercial restriction.

rollup-plugin-visualizerMIT

Permissive standard open-source license with minimal commercial restriction.

sassMIT

Permissive standard open-source license with minimal commercial restriction.

stylelintMIT

Permissive standard open-source license with minimal commercial restriction.

stylelint-config-prettierMIT

Permissive standard open-source license with minimal commercial restriction.

stylelint-config-standardMIT

Permissive standard open-source license with minimal commercial restriction.

terserBSD-2-Clause

Permissive standard open-source license with minimal commercial restriction.

testMIT

Permissive standard open-source license with minimal commercial restriction.

testcontainersMIT

Permissive standard open-source license with minimal commercial restriction.

typescriptApache-2.0

Permissive standard open-source license with minimal commercial restriction.

v-pagination-3MIT

Permissive standard open-source license with minimal commercial restriction.

viteMIT

Permissive standard open-source license with minimal commercial restriction.

vite-plugin-compressionMIT

Permissive standard open-source license with minimal commercial restriction.

vueMIT

Permissive standard open-source license with minimal commercial restriction.

vue-chartjsMIT

Permissive standard open-source license with minimal commercial restriction.

vue-confirm-dialogMIT

Permissive standard open-source license with minimal commercial restriction.

vue-contenteditableMIT

Permissive standard open-source license with minimal commercial restriction.

vue-i18nMIT

Permissive standard open-source license with minimal commercial restriction.

vue-image-crop-uploadISC

Permissive standard open-source license with minimal commercial restriction.

vue-multiselectMIT

Permissive standard open-source license with minimal commercial restriction.

vue-prism-editorMIT

Permissive standard open-source license with minimal commercial restriction.

vue-qrcodeMIT

Permissive standard open-source license with minimal commercial restriction.

vue-routerMIT

Permissive standard open-source license with minimal commercial restriction.

vue-toastificationMIT

Permissive standard open-source license with minimal commercial restriction.

vuedraggableMIT

Permissive standard open-source license with minimal commercial restriction.

wait-onMIT

Permissive standard open-source license with minimal commercial restriction.

whatwg-urlMIT

Permissive standard open-source license with minimal commercial restriction.

@grpc/grpc-jsApache-2.0

Permissive standard open-source license with minimal commercial restriction.

@louislam/pingMIT

Permissive standard open-source license with minimal commercial restriction.

@louislam/sqlite3BSD-3-Clause

Permissive standard open-source license with minimal commercial restriction.

@vvo/tzdbMIT

Permissive standard open-source license with minimal commercial restriction.

args-parserApache-2.0

Permissive standard open-source license with minimal commercial restriction.

axiosMIT

Permissive standard open-source license with minimal commercial restriction.

badge-makerCC0-1.0

Unrecognized license string. Manual review recommended during diligence.

bcryptjsMIT

Permissive standard open-source license with minimal commercial restriction.

chardetMIT

Permissive standard open-source license with minimal commercial restriction.

check-password-strengthMIT

Permissive standard open-source license with minimal commercial restriction.

cheerioMIT

Permissive standard open-source license with minimal commercial restriction.

chroma-js(BSD-3-Clause AND Apache-2.0)

Permissive standard open-source license with minimal commercial restriction.

command-existsMIT

Permissive standard open-source license with minimal commercial restriction.

compare-versionsMIT

Permissive standard open-source license with minimal commercial restriction.

compressionMIT

Permissive standard open-source license with minimal commercial restriction.

country-flag-emoji-polyfillMIT

Permissive standard open-source license with minimal commercial restriction.

cronerMIT

Permissive standard open-source license with minimal commercial restriction.

dayjsMIT

Permissive standard open-source license with minimal commercial restriction.

dev-nullMIT

Permissive standard open-source license with minimal commercial restriction.

dotenvBSD-2-Clause

Permissive standard open-source license with minimal commercial restriction.

expressMIT

Permissive standard open-source license with minimal commercial restriction.

express-basic-authMIT

Permissive standard open-source license with minimal commercial restriction.

express-static-gzipMIT

Permissive standard open-source license with minimal commercial restriction.

feedMIT

Permissive standard open-source license with minimal commercial restriction.

form-dataMIT

Permissive standard open-source license with minimal commercial restriction.

gamedigMIT

Permissive standard open-source license with minimal commercial restriction.

globalpingMIT

Permissive standard open-source license with minimal commercial restriction.

html-escaperMIT

Permissive standard open-source license with minimal commercial restriction.

http-cookie-agentMIT

Permissive standard open-source license with minimal commercial restriction.

http-graceful-shutdownMIT

Permissive standard open-source license with minimal commercial restriction.

http-proxy-agentMIT

Permissive standard open-source license with minimal commercial restriction.

https-proxy-agentMIT

Permissive standard open-source license with minimal commercial restriction.

iconv-liteMIT

Permissive standard open-source license with minimal commercial restriction.

is-urlMIT

Permissive standard open-source license with minimal commercial restriction.

isomorphic-wsMIT

Permissive standard open-source license with minimal commercial restriction.

jsescMIT

Permissive standard open-source license with minimal commercial restriction.

jsonataMIT

Permissive standard open-source license with minimal commercial restriction.

jsonwebtokenMIT

Permissive standard open-source license with minimal commercial restriction.

jwt-decodeMIT

Permissive standard open-source license with minimal commercial restriction.

kafkajsMIT

Permissive standard open-source license with minimal commercial restriction.

knexMIT

Permissive standard open-source license with minimal commercial restriction.

limiterMIT

Permissive standard open-source license with minimal commercial restriction.

liquidjsMIT

Permissive standard open-source license with minimal commercial restriction.

markedMIT

Permissive standard open-source license with minimal commercial restriction.

mittMIT

Permissive standard open-source license with minimal commercial restriction.

mongodbApache-2.0

Permissive standard open-source license with minimal commercial restriction.

mqttMIT

Permissive standard open-source license with minimal commercial restriction.

mssqlMIT

Permissive standard open-source license with minimal commercial restriction.

mysql2MIT

Permissive standard open-source license with minimal commercial restriction.

nanoidMIT

Permissive standard open-source license with minimal commercial restriction.

net-snmpMIT

Permissive standard open-source license with minimal commercial restriction.

node-cloudflared-tunnelMIT

Permissive standard open-source license with minimal commercial restriction.

node-radius-utilsMIT

Permissive standard open-source license with minimal commercial restriction.

nodemailerMIT-0

Permissive standard open-source license with minimal commercial restriction.

nostr-toolsUnlicense

Permissive standard open-source license with minimal commercial restriction.

notpUNKNOWN

Unrecognized license string. Manual review recommended during diligence.

openid-clientMIT

Permissive standard open-source license with minimal commercial restriction.

oracledb(Apache-2.0 OR UPL-1.0)

Permissive standard open-source license with minimal commercial restriction.

password-hashUNKNOWN

Unrecognized license string. Manual review recommended during diligence.

pgMIT

Permissive standard open-source license with minimal commercial restriction.

pg-connection-stringMIT

Permissive standard open-source license with minimal commercial restriction.

playwright-coreApache-2.0

Permissive standard open-source license with minimal commercial restriction.

prom-clientApache-2.0

Permissive standard open-source license with minimal commercial restriction.

prometheus-api-metricsApache-2.0

Permissive standard open-source license with minimal commercial restriction.

promisify-child-processMIT

Permissive standard open-source license with minimal commercial restriction.

protobufjsBSD-3-Clause

Permissive standard open-source license with minimal commercial restriction.

qsBSD-3-Clause

Permissive standard open-source license with minimal commercial restriction.

radiusUNKNOWN

Unrecognized license string. Manual review recommended during diligence.

redbean-nodeMIT

Permissive standard open-source license with minimal commercial restriction.

redisMIT

Permissive standard open-source license with minimal commercial restriction.

semverISC

Permissive standard open-source license with minimal commercial restriction.

socket.ioMIT

Permissive standard open-source license with minimal commercial restriction.

socket.io-clientMIT

Permissive standard open-source license with minimal commercial restriction.

socks-proxy-agentMIT

Permissive standard open-source license with minimal commercial restriction.

sqlstringMIT

Permissive standard open-source license with minimal commercial restriction.

tarISC

Permissive standard open-source license with minimal commercial restriction.

tcp-pingMIT

Permissive standard open-source license with minimal commercial restriction.

thirty-twoUNKNOWN

Unrecognized license string. Manual review recommended during diligence.

tldtsMIT

Permissive standard open-source license with minimal commercial restriction.

tough-cookieBSD-3-Clause

Permissive standard open-source license with minimal commercial restriction.

unlimited-timeoutMIT

Permissive standard open-source license with minimal commercial restriction.

validatorMIT

Permissive standard open-source license with minimal commercial restriction.

web-pushMPL-2.0

Weak copyleft requires preserving license notices and dynamic linking. Ensure no proprietary modifications are statically embedded.

wsMIT

Permissive standard open-source license with minimal commercial restriction.

2. Key-Person Bus Factor

Bus Factor: 16

Balanced engineering contribution across 97 authors. Primary contributor represents 51.8% of commits.

Primary Contributor:louislam
Commit Share:51.8%
Transition Escrow Recommended:Yes

3. Secret & Credential Patterns

1 Found

Found 1 credential exposure(s) in scanned codebase.

Private Cryptographic Keytest/manual-test-radius-tls/certs/redis.key

Rotate private key pair and re-issue associated certificates.

4. Architecture & Test Health

Score: 35/100

Sparse test coverage (<20% test-to-source ratio); elevated regression risk.

  • •563 source file(s) and 46 test file(s) identified in the analyzed tree.
  • •Recommended: Expand automated integration tests for critical business pathways.

Automated analysis detects a subset of technical risks. License classification covers the direct dependencies declared in the repository's package.json; the secret-pattern scan covers a risk-prioritized subset of files in the current default-branch tree, not the full repository or its history. This report is not legal advice and is not a substitute for full transaction diligence.

Ready to Audit Your Next Acquisition?

Get the same report for your target repository, with the negotiation matrix priced to your deal.

Start Technical Due Diligence ($349) →