Most VC due diligence checklists focus on financials, legal, and market size. They miss the single most honest signal a startup has: its GitHub.
A pitch deck tells you what the founders want you to know. Their Git history tells you what they actually did.
After analyzing GitHub data from 219 funded startups (paper here), I built a 52-point checklist. Here it is, free.
Why GitHub matters in due diligence
Three things show up in code that never appear in a deck:
- Actual shipping velocity (not claimed velocity)
- Team health (are contributors leaving silently?)
- Infrastructure maturity (are they building for scale or winging it?)
The checklist (abridged)
Repository health (12 checks)
- Commits in last 30 days?
- No abandoned repos (>90 days inactive)?
- README and LICENSE present?
- CI/CD workflows configured?
- Branch protection enabled?
- PR merge rate >50%?
- No critical CVEs in dependencies?
- SECURITY.md present?
Commit velocity (8 checks)
- Weekly commits stable or increasing over 90 days?
- No sudden drops >60% week-over-week?
- Commit messages follow a consistent pattern?
- Night/weekend commits (genuine engagement)?
- No suspicious bot-generated patterns?
- Velocity correlates with claimed headcount?
- Spikes align with claimed milestones?
- Compare to sector benchmarks
Team signals (10 checks)
- More than 3 active contributors in last 90 days?
- Contributor count growing quarter-over-quarter?
- No mass contributor exodus (>40% drop)?
- Key engineers have LinkedIn profiles matching GitHub?
- CTO/founder still commits code?
- No ghost contributors (empty profiles)?
- Bot accounts labeled and scoped?
Infrastructure buildout (8 checks)
- CI/CD pipeline configured (GitHub Actions, etc.)?
- Containerization present (Dockerfile)?
- Infrastructure-as-code (Terraform, Pulumi)?
- Monitoring/observability configs present?
- Staging environment exists?
- Feature flags configured?
- API documentation published?
Security posture (6 checks)
- Dependabot or equivalent enabled?
- No public secrets/keys in commit history?
- 2FA enforcement visible?
- Code scanning (CodeQL/Semgrep) enabled?
Product-market fit signals from code (8 checks)
- Rate of new feature branches increasing?
- Customer-facing repos (SDKs, integrations) active?
- Localization efforts in code?
- Billing integration present and current?
- Database migration scripts (real product evolution)?
How to use it
Run this checklist against any startup's public GitHub before the pitch meeting. Most of it can be automated using the GitHub API.
I track 350+ startups across 15 sectors automatically at VC Deal Flow Signal, which scores each startup on engineering acceleration and flags when signals spike before a funding round.
The sector benchmark trap
Don't compare a Healthcare startup to a Developer Tools startup. Developer Tools companies ship 2.3x more than Healthcare. Always compare within the same sector.
Here are median weekly commits by sector (Q2 2026):
| Sector | Median weekly commits |
|---|---|
| Developer Tools | 89 |
| Data Infrastructure | 52 |
| Web3 | 56 |
| AI/ML | 47 |
| Enterprise SaaS | 38 |
| Fintech | 34 |
| Healthcare | 22 |
Full sector breakdown with 350+ startups is at signals.gitdealflow.com.
The honest part
My first 10 pre-registered predictions went 0-for-10. I published that result anyway. The methodology improved. The current backtest covers 219 fundraises.
The point isn't that GitHub signals are perfect. They're a leading indicator that gives you 30-47 days of runway before a round is announced. Use it to get in early, then verify with traditional diligence.
Full methodology and the 0-for-10 transparency ledger: SSRN paper.
The full 52-point checklist is also on GitHub: vc-due-diligence-checklist.
The author runs GitDealFlow, a GitHub-powered deal flow intelligence tool. All data and methodology are open. CC BY 4.0.
Top comments (0)