Due Diligence

Security, licensing,
and legal transparency.

Everything a buyer should verify before escrow. No surprises after the wire.

01 — Security posture

No runtime secrets.
No external services.

The certifier has zero third-party runtime dependencies. The platform uses standard Next.js auth and database patterns.

CertifierZero runtime deps

Node stdlib + repo-local modules only

No npm packages at runtime. tsx is a devDependency only. Attack surface: Node process + file I/O.

  • No network calls (market data fetched via optional Yahoo Finance library)
  • No secrets in code — all config via CLI args
  • No eval, no dynamic imports, no child_process except for market data fallback
PlatformStandard Next.js stack

Clerk auth + Prisma + PostgreSQL

Industry-standard patterns. No custom crypto, no custom auth flows.

  • Auth: Clerk (managed, SOC 2 Type II)
  • Database: Prisma ORM (parameterized queries, no SQL injection)
  • API: REST + validation via Zod schemas
  • Secrets: DATABASE_URL, CLERK_* — standard .env pattern
CI / Supply Chainpnpm + GitHub Actions

Locked dependencies, no auto-merge

  • pnpm-lock.yaml committed — deterministic installs
  • GitHub Actions with pinned action versions
  • No self-hosted runners — GitHub managed
  • Dependabot disabled (intentional — manual review only)

Static analysis

TypeScript
Strict mode, tsc --noEmit passes (CI step)
ESLint
Next.js config + TypeScript ESLint, zero warnings (CI step)
Mutation Testing
49/49 guard mutations caught — each verified non-vacuous
Secrets Scan
No secrets in repo history (verified by clean-slate gate)
02 — Dependency licenses

Full transparency.
No copyleft surprises.

All third-party licenses are permissive (MIT, Apache-2.0, BSD). No GPL, AGPL, or viral licenses in the dependency tree.

Certifier — Zero runtime dependencies

The certifier runs on Node 22 stdlib (node:fs, node:path, node:crypto, node:child_process) plus repo-local modules under src/modules/model-certification/. tsx (MIT) is a devDependency used only to run the TypeScript entry point. No third-party packages at runtime.

Platform — Key dependencies

PackageVersionLicensePurpose
next16.3.8MITReact framework
react19.2.4MITUI library
react-dom19.2.4MITDOM renderer
prisma6.xApache-2.0ORM
@prisma/client6.xApache-2.0DB client
tailwindcss4.xMITCSS framework
zod4.xMITValidation
@clerk/nextjs7.3.7MITAuth
@tanstack/react-query5.100.10MITData fetching
framer-motion12.38.0MITAnimation
lightweight-charts5.2.0Apache-2.0Financial charts
yahoo-finance23.14.0MITMarket data
stripe22.6.2MITPayments (unused in certifier)
date-fns4.1.0MITDate utils
lucide-react1.14.0ISCIcons
clsx2.1.1MITClass names
tailwind-merge3.6.0MITTailwind utils
lru-cache11.3.6ISCCaching
rss-parser3.13.0MITRSS parsing
yaml2.9.1ISCYAML parsing
zustand5.0.13MITState mgmt
immer11.1.8MITImmutability
@radix-ui/react-tooltip1.2.8MITTooltip
@temporalio/*1.16.2MITWorkflow (platform only)

Note: Full dependency trees with transitive licenses available in the repository via pnpm licenses list --json. All licenses are permissive (MIT, Apache-2.0, ISC, BSD-3-Clause). No GPL, AGPL, LGPL, or other copyleft licenses detected.

03 — MIT licence history

Public window:
1–22 October 2026.

The repository was public under an MIT licence for 22 days. This is disclosed in writing. Exclusivity cannot be warranted.

01

Public under MIT

Repository was public under MIT licence from 1–22 October 2026. Anyone who copied it then holds a perpetual MIT licence to that snapshot.

02

No exclusivity warranted

The sale does not claim exclusivity. The MIT snapshot from that window may exist in forks, mirrors, or local copies.

03

Current status: Private

Repository is now private. Visibility verified via GitHub API by CI gate (tests/clean-slate/visibility.spec.ts).

04

AI disclosure

Development used AI coding tools extensively. Copyright in purely AI-generated expression is unsettled. Disclosed in AI_DISCLOSURE.md.

MIT Window
1–22 October 2026 (22 days)
Current Visibility
Private (verified by CI on every PR)
Licence Now
Proprietary evaluation licence (see LICENSE)
Full Commercial Rights
Transferred only on execution of Asset Purchase Agreement + payment
04 — AI assistance disclosure

Substantially AI-assisted.
Disclosed in writing.

Development used AI coding tools extensively. This is not a defect — it is a fact. Buyers should conduct independent legal diligence.

01

AI tools used

Claude (Anthropic), GitHub Copilot, Cursor, and other LLM-based coding assistants were used throughout development.

02

Copyright status

Whether AI-generated expression attracts copyright protection is unsettled in most jurisdictions. The seller does not represent this risk is zero.

03

Human oversight

All code was reviewed, tested, and mutation-verified by the builder. The tests, CI, and architecture decisions are human-directed.

04

Documentation

Full disclosure in AI_DISCLOSURE.md in the repository. Provided to buyers before escrow.

05 — Repository visibility

Private. Verified by CI.
Not asserted — checked.

The repo is private. A CI gate queries the GitHub API on every PR to prove it. If it ever becomes public, the build fails.

Current Status
Private (verified 2026-11-04)
Verification Method
GitHub API GET /repos/{owner}/{repo} — private: true
CI Gate
tests/clean-slate/visibility.spec.ts — blocks merge if public
Branch Protection
Required status checks: typecheck, lint, test, build, visibility
Access Model
Granted per buyer; no public access
06 — Legal terms summary

Asset purchase.
Escrow first. No surprises.

Full written terms provided before any payment. This is a summary for due diligence.

Escrow funded

Buyer funds escrow for full $4,950. Nothing moves before this.

Repo transferred

Full repository transfer at agreed commit, as squashed snapshot.

Buyer confirms

Buyer checks what was received against these terms.

Escrow releases

Funds release only after confirmation. No repo access before escrow funds.

Price
$4,950 USD, one payment only. No instalments, no revenue share, no earn-out.
Escrow Fee
Paid by buyer, or deducted from proceeds at close.
Handover
7–14 days of questions only. No SLA, no maintenance, no future updates.
Proof Pack
Free short summary available to anyone. Full pack shared privately after screening, under evaluation-only licence.
Exclusions
No customers, accounts, API keys, .env, licensed data feed. Buyer supplies own keys and database.
Condition
Sold as-is. Liability capped at sale price. Full written terms provided before payment.
MIT History
Repository was public under MIT from 1–22 Oct 2026. Exclusivity not warranted.
AI Disclosure
Substantially AI-assisted. See AI_DISCLOSURE.md. Buyer diligence advised.
Read full sale terms

No hidden risks. Everything disclosed above.

Start due diligence Read full terms