CodeVet

Idea

A self-serve technical due diligence report for buyers of small software-enabled businesses. CodeVet connects to a target company's GitHub or GitLab repo, runs an automated security, license, complexity, and bus-factor scan, and turns it into a plain-English risk report in hours. It is built for search fund principals, independent sponsors, and self-funded searchers who cannot justify a $5,000 to $30,000, multi-week boutique diligence engagement on a sub-$10 million deal. Reports start at $299 with instant checkout, no demo call and no sales team.

Market gap

Every existing option for software technical due diligence is priced and sold for institutional-scale deals. MEV and boutique firms like madewithlove, UIDB, Selbytech, and Hunchbite sell manual engagements that run $5,000 to $30,000 and take two to four weeks. Sema and CodeScene automate the scan itself, but Sema is demo-gated (no public pricing, "get in touch" only) and has analyzed over $150 billion in digital transaction volume, meaning it is built and sold for institutional M&A, not a $2 million SaaS company. CodeScene is sold to engineering teams for ongoing CI/PR code health, not packaged as a one-time buyer-facing diligence deliverable. DueDilio is a marketplace that still routes a searcher to a human consultant at consultant rates.

Meanwhile the buyer population that actually needs this is growing and is famously diligence-budget-constrained. Stanford's search fund research shows a record 94 new traditional search funds launched in 2023, with launch levels staying historically high through 2025. The median search fund acquisition is now $16 million, but ETA deals range far below that, and self-funded searches typically target $1 million to $10 million businesses. Searchers "rarely have an in-house CTO to check the code themselves," per MEV's own writeup, and a real thread on Searchfunder.com shows buyers actively asking the community for technical diligence recommendations and cost expectations on small deals. The timing is right because ETA has never been more popular, self-funded search has become the dominant path into it, and every incumbent still requires a sales call or a five-figure check just to get started.

Total Addressable Market (TAM)

Traditional search funds: 94 new funds launched in 2023, a record year, with launch levels historically high through 2025 (Stanford data, via Investing.io and ClearlyAcquired). Using 90 per year as a round estimate for recent years. Median search duration is 20 months (Stanford data, via Papermark), so the steady-state pool of actively searching traditional funds at any time is about 90 x (20 divided by 12) = 150.

Assumption (not sourced, flagged as an estimate): each actively searching fund reaches a serious, LOI-stage diligence event on roughly 1 target per year, and about 35 percent of those targets are software or software-enabled businesses material enough to warrant a codebase scan. 150 x 1 x 0.35 = 53 diligence events per year from traditional search funds.

Self-funded searchers: the 2023 SIG survey counted 279 self-funded searcher respondents (via Investing.io), explicitly a survey sample with acknowledged self-selection bias, not a full census. Used here as a conservative floor rather than inflated further. Applying the same assumption: 279 x 1 x 0.35 = 98 diligence events per year.

Self-funded searchers are the more underserved half of this math. They carry even leaner budgets than a capitalized traditional fund, so today most of them likely skip paid technical diligence entirely rather than pay MEV or Sema prices. That gap is the core opportunity, not spend redirected from a competitor.

Total diligence events per year: 53 + 98 = 151. Blended average revenue per report across the $299, $799, and $1,499 tiers: about $650. TAM = 151 x $650 = about $98,000 per year.

This is a deliberately narrow, sourced number. It excludes independent sponsors, micro-PE add-on buyers, and M&A advisory firms who could resell reports across their own deal flow, all real adjacent buyers with no reliable public headcount, so they are named as unquantified upside rather than folded into the TAM.

SAM: effectively the same population, since almost all of it is reachable through a handful of concentrated channels: Searchfunder.com, ETA-focused newsletters and podcasts, university search fund programs, and ETA's small but active community on Twitter/X. Call it $80,000 to $95,000 per year, discounting slightly for searchers outside those channels.

SOM: a two-person team wins trust slowly, since buying diligence software instead of hiring a known consultant is a new behavior. Assume 10 to 15 percent of SAM in year one via direct community distribution plus one referral relationship with a marketplace like DueDilio: roughly 12 to 20 reports in year one, or $8,000 to $13,000 in first-year revenue, growing as the category gets discovered and reports get shared inside search fund cohorts and investment committee decks.

Monetization strategy

Pay-per-report, not a subscription, because the need is transactional and tied to a specific deal, not an ongoing seat. A buyer pays once per target company evaluated. Repeat revenue comes from the same buyer running reports on multiple competing LOIs during one search, and later, from mid-market M&A advisors and diligence marketplaces reselling reports across their own client deal flow at a wholesale rate. They keep paying because a $299 to $1,499 report is cheap insurance against inheriting an undocumented, single-engineer codebase after close, and because it is faster than waiting on a consultant's two-to-four-week slot during an active LOI window.

Pricing strategy

• Snapshot, $299: one repository, full automated scan, web report only. The entry point for checking a single target early, or comparing two competing LOIs before committing diligence budget to either.
• Standard, $799 (anchor): up to 5 repositories or services, adds a downloadable PDF built for an investment committee memo, plus report-scoped AI chat for follow-up questions. This is the tier most single-company acquisitions need.
• Data Room, $1,499: multi-repo or monorepo and microservices support, for a target with a more complex platform. Same PDF and chat.
• Optional add-on, $500: a 30-minute human sanity-check call with a fractional CTO, for a buyer who wants a person to sign off before wiring funds. This also opens a path upmarket later without turning the core product into a services business.

Lead magnet

A free, email-gated "Codebase Health Score" for any public GitHub repository. Paste a repo URL, get a single letter grade and 3 headline risk flags in under a minute, no full report. It proves the scan actually works on a real repo before anyone pays, and it is naturally shareable inside ETA Twitter/X and Searchfunder threads, where people already post repo links and ask if a codebase looks okay.

Social proof that the problem exists

1. https://searchfunder.com/post/softwaretechnical-due-diligence-in-a-small-business-acquisition, a real searcher on Searchfunder.com asking the community how to run technical diligence on a target's proprietary software, what it costs, and who to hire, because they are not a programmer themselves.
2. https://www.searchfunder.com/post/seeking-recommendations-for-technical-due-diligence-partners-in-saas-ma-de, a separate Searchfunder.com thread specifically seeking technical due diligence partner recommendations for a SaaS M&A deal, showing this is a recurring, not one-off, community need.
3. https://mev.com/blog/technical-due-diligence-for-search-funds-and-eta-acquisitions, a firm selling exactly this service states plainly that searchers rarely have an in-house CTO to check the code themselves, and prices manual engagements at $5,000 to $30,000 over two to four weeks, confirming both the pain and the price point buyers currently pay.
4. https://www.semasoftware.com/blog/the-rise-of-comprehensive-codebase-scans-transforming-technical-due-diligence, showing automated codebase scans for diligence are a real and growing practice, with over $150 billion in digital transaction volume analyzed, but built and sold for institutional-scale M&A, evidence of the gap at the small-deal end.

Competitors

• MEV: boutique firm running manual buy-side and vendor-side technical due diligence specifically for search fund and ETA buyers. Fixed fee $5,000 to $30,000, two to four week turnaround, human-led.
• Sema: SaaS platform (Health Check, Diligence Report, Maintenance Platform) that automates codebase scans across code quality, security, IP and license, and team and process signals. Demo-gated, no public pricing, positioned for large institutional M&A and PE transactions.
• CodeScene: automated code health analysis with a quantitative CodeHealth score, sold mainly as an ongoing engineering tool integrated into CI and PR review, not packaged as a standalone buyer-facing diligence report.
• madewithlove, UIDB, Selbytech, Hunchbite: independent dev agencies and consultancies that sell manual technical due diligence as a professional services engagement, billed per project.
• DueDilio: a marketplace that matches buyers to vetted third-party diligence providers, including technical reviewers. Still ends in hiring a human consultant at consultant rates, not a self-serve product.

What competitors offer now

The service-based players (MEV, madewithlove, UIDB, Selbytech, Hunchbite, and DueDilio's network) all require scoping a call, waiting one to four weeks, and paying five figures, which only makes sense against a deal large enough to absorb that cost and timeline. The automated players (Sema, CodeScene) have built the hard part, real static analysis and codebase scoring, but gate it behind sales conversations and price it for enterprise budgets. None of the five let a solo searcher pay a card, connect a repo, and get a report the same day, and none price a single-target scan under $1,000.

What can be done differently to attract customers

Sell the exact opposite motion from every incumbent: no call, no quote request, instant checkout, same-day report, and a price low enough that a solo self-funded searcher can run it on a whim while still at the LOI stage, before deciding the deal is worth a real diligence budget. Distribute through the free letter-grade lead magnet inside the ETA community's own channels (Searchfunder, ETA newsletters, ETA Twitter/X, university search fund clubs) instead of enterprise sales outbound, and let the product's own output, a report searchers screenshot into their investment committee memo, do the selling.