Source code due diligence: what buyers review in a software sale

What is source code due diligence?

Source code due diligence is the part of technical due diligence in which a buyer, or a specialist firm it hires, examines a software company's repositories, dependencies and development process before signing. It answers four questions: does the company own what it sells, may it legally ship it, is it secure, and can the team keep improving it? The findings feed the price, the IP representations in the purchase agreement and any special indemnities.

For sellers and their advisors, the review has a second use. The artifacts it examines (commit history, pull requests, review comments, linked tickets and incident write-ups) are records of real engineering work with outcomes, and AI developers pay to license that kind of history when they train and evaluate coding agents.

What do buyers review in code diligence?

How does a code review run during a sale?

1. Scope and clean team. The buyer names who will see code, frequently an outside firm, under the NDA and a clean-team protocol.
2. Access model. The seller chooses how code is examined: guided screen-share sessions, read-only access in a controlled environment, or scans run by a third party that reports findings without keeping copies. Sellers can limit raw code access until signing.
3. Automated scans. Software composition analysis, license detection and secret scanning across the full history, not just the main branch.
4. Manual review and interviews. Reviewers sample critical modules and interview the CTO and lead engineers about architecture, debt and roadmap.
5. Findings report. Issues are rated by severity, with remediation estimates.
6. Deal terms. Findings shape IP and open-source representations, specific indemnities, escrow or holdback amounts and, where used, the exclusions in representations and warranties insurance.

Sellers who run their own pre-sale scan, sometimes called sell-side code diligence, find problems on their own schedule rather than the buyer's.

Who owns the code? The question behind most findings

Ownership gaps are the findings most likely to move price. Under US copyright law, a work prepared by an employee within the scope of employment is a work made for hire, and the employer is treated as its author (17 U.S.C. § 101). Commissioned work from an outside contractor counts as a work made for hire only if it falls within one of nine listed categories and both parties sign a written agreement saying so. Outside those categories, the company generally needs a written assignment from the contractor to own the work, as the Copyright Office's Circular 30 on works made for hire explains.

In practice, reviewers match the contributor list in Git against employee and contractor records and look for gaps: a founder's code written before incorporation, an offshore agency without an assignment clause, an acquired codebase with incomplete paperwork. Those gaps matter twice, once for the sale and again for any data license, because a company can only license what it owns.

This is general information, not legal, tax or financial advice. Ownership questions belong with deal counsel, who can confirm how the rules apply to the company's own contracts.

Why the same records can be licensed

What a diligence team skims for risk, an AI developer reads as training material. Coding agents learn from how engineers actually work: a ticket describing a bug, the pull request that fixes it, the reviewer's objections, the revised commit, the failed CI run and the eventual merge. That sequence, with its outcome, is scarce in public repositories for proprietary business software.

A seller who has just been through diligence, or is preparing for it, has already done much of the mapping a data inventory needs. Agencies that write code for clients face extra rights questions, covered in the guide to what a software development company owns.

How a software M&A advisor spots a candidate

You do not need to read code to spot a candidate. Ask the CTO three things: how many years of history live in Git and the issue tracker, whether pull requests are reviewed and linked to tickets, and whether every contributor signed an assignment. Clear answers to all three, at a company with 50+ full-time employees at peak (contractors excluded), justify a company fit check. The referral page for M&A advisors describes the partner program from a deal adviser's side.

Then settle timing with the client. A license before the sale is the seller's call and belongs in the disclosure schedules; once the deal closes, the buyer makes that call. Owners who fear that licensing code means handing over the product should read whether licensing company data gives away the crown jewels: the company keeps ownership, and scope, permitted use and redaction are set in the agreement it signs. For the wider picture of how AI is changing what software buyers ask, see software M&A trends in 2026.

Partners only make the introduction; they never receive, export or describe code. Partners earn 25% of the eligible platform fees SourceX actually collects from the referred company's licensing deals, capped at $100,000 per referred company, payable after the buyer pays and SourceX receives its fee, and no reward is guaranteed. The reward is funded from SourceX's fee, not from the seller's payment. Check your own engagement letter, firm policy and any professional or securities rules on referral fees and disclosure before registering.

Limits and open questions

• Not all code qualifies. Client-owned code, code under restrictive third-party licenses and repositories with unresolved ownership gaps are excluded or need consent.
• Security concerns are legitimate. Secrets, customer data in test fixtures and internal hostnames have to be stripped out under redaction rules the company approves up front.
• The policy debate on AI training continues. The US Copyright Office's Copyright and Artificial Intelligence report includes a Part 3 on generative AI training, released as a pre-publication version in May 2025, which examines where copying for training may implicate copyright and how practical licensing approaches are. It is analysis, not law.
• Diligence findings travel. If a buyer's review finds an ownership gap, fix it before any license is signed, not after.

Next step

Before your next software client opens its data room, ask the three CTO questions. Clean answers mean it is time to register as a partner and send the founder your referral link, which opens the company application at sourcex.si/apply. For subscription businesses, the guide to selling a SaaS company covers the records that matter beyond ARR.