GitHub Due Diligence Checklist
This is the checklist version of technical due diligence: 21 checks across four categories, each answerable from public GitHub data, plus a scoring rubric and a practical guide to running it in the GitHub UI. Run it on any software startup before you invest, and attach the scored result to your investment memo.
How the checklist is organized
The 21 checks are grouped into four categories that map to four questions: velocity (are they shipping?), team (are they real and scaling?), process (how do they work?), and expansion and red flags (where are they heading?). Work through them in order, and record pass, warn, or fail for each.
Each check below includes a short note on what a healthy result looks like, so you are scoring against a standard rather than a feeling. None of the checks requires reading code; all of them are answerable from the GitHub web interface in under an hour.
Velocity: is the team actually shipping?
| Check | What good looks like |
|---|---|
| 1. Is 12-week commit velocity trending up, flat, or down? | A rising 4-week average over the quarter, not a one-week spike. |
| 2. Is there a sustained rise, or only a single-week spike? | Sustained momentum across 8+ weeks; spikes are noise. |
| 3. Does the velocity match the founder's claims? | The public record confirms the pitch, rather than contradicting it. |
| 4. Is there active development in the core product repos? | Recent commits in the repos behind the actual product, not a stale demo. |
| 5. Are there abandoned repos suggesting a pattern of not finishing? | Few or no half-built repos left mid-feature. |
Team: is the engineering team real and scaling?
| Check | What good looks like |
|---|---|
| 6. How many distinct contributors committed in the last 90 days? | A team count that matches the stage, not a single author. |
| 7. Is contributor count growing, flat, or shrinking? | Growth consistent with the hiring plan; a decline is worth probing. |
| 8. Is the work concentrated in one founder? | Work spread across multiple contributors; concentration is fragility. |
| 9. Does the team size match what the founder claimed? | The public record confirms the pitch, not the opposite. |
| 10. Is there short-tenure contractor churn inflating the count? | A stable contributor base, not a revolving door. |
Process: how do they actually work?
| Check | What good looks like |
|---|---|
| 11. Are pull requests reviewed before merge? | Reviewed PRs, not unreviewed merges to main. |
| 12. Are issues triaged and closed? | Issues opened and closed at a steady clip, not piling up. |
| 13. Is there a test suite, and is it run? | Tests present and run in CI, not absent. |
| 14. Are releases tagged and versioned? | Tagged releases with version numbers, not untracked pushes. |
| 15. Is commit history coherent? | Descriptive commit messages, not a wall of vague 'fix' entries. |
| 16. Is there documentation? | Maintainable code with docs, not undocumented internals. |
Expansion and red flags: where are they heading?
| Check | What good looks like |
|---|---|
| 17. Are new repositories appearing? | New repos consistent with a product push, not stagnation. |
| 18. Does codebase growth match the roadmap? | The direction of the code aligns with the pitch. |
| 19. Is there a velocity spike right before the raise? | Pre-raise acceleration is normal, but a spike that does not match history is a question. |
| 20. Do public claims contradict the record? | The pitch, team page, and product all agree with the code. |
| 21. Does the footprint match the stage and sector? | The footprint looks right for a team of that maturity in that sector. |
How to run the checklist in GitHub
Every check above is answerable from three places on GitHub: the organization page (which lists repositories and their activity), the Insights tab on each repository (Contributors and Pulse for velocity and team data), and the Pull Requests and Issues tabs (for process quality).
The fastest path: start on the organization page to map the footprint, then open the two or three repositories that are the actual product, and read their Insights, Pull Requests, and Issues views. For velocity and contributor checks, the Contributors view under Insights is where the raw data lives. A 30 to 60 minute pass per company is enough to complete the checklist.
Keep a simple spreadsheet with one row per check and columns for the result and a one-line note. That note is what makes the checklist useful in a memo, because a bare pass or fail without the underlying evidence does not survive scrutiny three weeks later.
How to score the checklist
Score each check as pass, warn, or fail. Then use a simple rubric:
- Strong: 18 or more pass, no fails. The engineering substance supports the deal.
- Mixed: 12 to 17 pass, or 1 to 2 fails. Proceed only if the founder answers the warns cleanly.
- Weak: fewer than 12 pass, or 3 or more fails. The engineering evidence does not support the investment.
The point is not the number; it is forcing every claim through a public-evidence filter. A founder who clears the checklist cleanly has done something real.
Reading the results: what strong, mixed, and weak look like
A strong result (18 or more pass, no fails) is a team whose public record confirms the pitch: shipping steadily, scaling the team, working with discipline, and heading where the roadmap says. That is the evidence you want behind a check, and it is worth writing down in the memo.
A mixed result (12 to 17 pass, or 1 to 2 fails) usually means a real team with one or two open questions: maybe velocity is flat this quarter, or process is sloppy in public, or the team is still concentrated in one founder. These are founder conversations, not deal-breakers, but they need to happen before you sign.
A weak result (fewer than 12 pass, or 3 or more fails) means the engineering evidence does not support the investment as pitched. That does not always mean a bad company, but it does mean you are being asked to invest on narrative rather than evidence, which is a very different bet and should be priced accordingly.
What to do with the results
Attach the scored checklist to your investment memo. The pass and warn items become your diligence questions for the founder; the fail items become either deal-breakers or the specific conditions you negotiate around.
For teams where the core product is private, note the thinner footprint explicitly and lean on qualitative diligence instead of pretending the signal is complete. The checklist's value is that it makes the evidence, and the gaps in the evidence, explicit before you sign.
Finally, keep the checklist as a living document. Re-run the velocity and team sections quarterly on every company you are tracking, and note the trend. A company whose score is improving quarter over quarter is a different asset than one whose score is quietly declining.
Frequently Asked Questions
How long does this checklist take to run?
With a signal layer that already tracks velocity and contributor growth, the velocity and team sections take minutes. The process and red-flag sections require reading the repositories, which is 30 to 60 minutes per company.
Is this checklist only for software startups?
It is strongest for software and software-adjacent companies where code is the product. For hardware and biotech, the public footprint is thinner and you should weight qualitative diligence more heavily.
Can I use this checklist for open-source-heavy companies?
Yes, and you should add a check for external contributor pull: is the open-source community actually using and contributing to the project? For developer-tools companies, that is early product-market fit in code form.
What is the single most important check?
The 12-week velocity and contributor trend, because it converts the founder's momentum claims into a verifiable record and is the hardest signal to fake over a meaningful window.
Should I run this for a seed round?
Yes, but weight it by stage. At seed you are checking that the team can execute, not auditing a mature architecture. The same public evidence answers the seed question: is this team actually shipping?
What should I do when the checklist and the pitch disagree?
Believe the checklist, then ask the founder. The public record is the one account the founder did not write for you, so a mismatch is a specific, answerable question rather than a reason to quietly pass.
How do I track a company's checklist score over time?
Re-run the velocity and team sections quarterly and note the trend. A rising score confirms an improving asset; a quietly declining score is an early warning that financials and press will not show for months.