Sample report: this is what a Vestige scan delivers. Print or save as PDF to share with your deal team.
Vestige Technical Due Diligence
June 29, 2026 · 1,847 commits · 203 PRs · TypeScript
Summary
The payments-platform repository shows a mature codebase with concentrated ownership risk in its most critical modules. Two findings warrant attention before close: a cluster of unreviewed patches to the authentication layer with no corresponding issue or PR context, and a critical billing module with no active maintainers. A stalled database migration and a test coverage gap are flagged for post-close remediation planning.
Findings (4)
Three sequential patches to auth/parseToken.ts were committed directly to main with no PR, no issue link, and commit messages of 'fix', 'add null check', and 'update validation'. The commits were made in rapid succession and bypassed the standard review process entirely. The pattern is consistent with emergency remediation of an unlogged event; the seller should be able to account for the change cluster.
Evidence: Commits a3f9c2b · b81e04a · c29f17d · auth/parseToken.ts · auth/validateUser.ts · middleware/auth.ts
△ If the seller cannot explain this sequence, that absence is itself a finding. Ask before close, not after.
Pending reviewer sign-off
billing/charge.ts has accumulated 1,204 commits across 9 contributors, but three engineers who authored 71% of its commits have all left within the past 18 months. The module is imported by 31 other modules and handles payment processing and retry logic. No documentation of its behavior exists in the repository.
Evidence: git log --follow billing/charge.ts · 1,204 commits · 9 authors · 31 import references
△ Any change to this module carries undocumented institutional risk. The next engineer to touch it has no map.
Pending reviewer sign-off
migrations/0047_payments_schema.sql was created 14 months ago and never applied. The branch that introduced it was closed without merge. Three subsequent commits reference the schema change as 'pending'. It is unclear whether the migration was abandoned intentionally or deferred indefinitely.
Evidence: migrations/0047_payments_schema.sql · branch payments/schema-update (closed, unmerged) · 3 references to 'pending schema'
Pending reviewer sign-off
The retry and failure-handling logic in billing/charge.ts spans approximately 847 lines with no dedicated unit test file. The only coverage is a single integration test for the happy path; no tests exercise the failure or retry branches.
Evidence: Pattern analysis of test/ directory · billing/charge.ts LOC count · test/integration/billing.test.ts (happy path only)
Pending reviewer sign-off
Key Person Risk
Three of the nine contributors who shaped the most critical modules have left in the past 18 months. The authentication and billing systems, both high-dependency and high-risk, are now effectively unmaintained by anyone with direct context.
| Contributor | Commits | Last active | Primary module | Risk |
|---|---|---|---|---|
| J. Hartwell | 412 | Nov 2024 | billing/charge.ts | High |
| M. Osei | 287 | Feb 2025 | auth/ | High |
| A. Thornton | 164 | Jan 2025 | payments/retry.ts | Medium |
Confidence Tiers
Sign-off
Each finding in this report requires a named reviewer to independently verify or correct it before the report is considered final. Sign-offs are timestamped and attributed. The report reflects the reviewer's findings, not Vestige's.
Reviewer name
Date
Title / Firm
Signature