Debt exposure
68/100
Material
Material
Visible engineering risk that can affect delivery or customers.
TECHNICAL DEBT, TRANSLATED
Know what debt will cost before it costs you.
Turn a public repository into a founder-ready view of engineering risk—what is exposed, why it matters, and what your team should fix first.
01 Repository evidence02 Business impact03 30-day plan
Sample analysis
founder-signal
Shaaz1000/founder-signal main branch
High priority
3items need leadership attention
Fix firstRelease confidence
Lowbased on visible delivery controls
0 automated gates foundTest signal
5%test files relative to source surface
4 tests · 84 sourceRISK BY AREA
Higher = more attentionWhere exposure is concentrated
Protect the release path before expanding the product surface.
Fewer regressions, safer releases, and less founder escalation.
See the 30-day plan →HIGH-PRIORITY ITEMS
What needs attention first
Ranked by severity and likely business impact—not by how easy the fix is.
01
criticalReliability · Risk score 92
The critical path has no visible safety net
What this means: A small regression can interrupt revenue, increase support load, and pull founders into emergency decisions.
Evidence found
No automated tests protect authentication, billing, or the primary customer workflow.
Recommended action
Add five critical-path tests and require them before every merge.
02
highDelivery · Risk score 84
Releases can merge without an automated gate
What this means: Release confidence depends on individual memory, making speed less predictable as the team grows.
Evidence found
No required build, type-check, and test workflow is visible in the repository.
Recommended action
Create one required CI workflow covering build, type-check, and critical tests.
03
highSecurity · Risk score 72
Security ownership is not explicit
What this means: Known vulnerabilities may remain unowned until an enterprise buyer or incident makes them urgent.
Evidence found
No SECURITY.md or automated dependency update policy is visible.
Recommended action
Name an owner, publish the reporting path, and enable weekly dependency updates.
04
mediumMaintainability · Risk score 58
Change risk is concentrating in large modules
What this means: Reviews slow down and feature work increasingly touches unrelated behavior.
Evidence found
Core product behavior is concentrated in a small number of broad source files.
Recommended action
Extract one stable boundary from the most frequently changed module.
PLAIN-ENGLISH DEFINITIONS
What each score means
No engineering background required. These are business-facing interpretations of repository signals.
Reliability82
How likely the product is to fail or regress during normal use.
The critical customer path has limited automated protection.Delivery76
How safely and predictably the team can ship changes.
Changes can reach production without a consistent quality gate.Security61
How clearly the codebase prevents, detects, and owns security exposure.
Vulnerability ownership and update automation are implicit.Maintainability53
How difficult the system is becoming to understand and change.
A few modules are becoming expensive to change safely.A BOUNDED RESPONSE
Your 30-day plan
Sequenced so a small team can reduce exposure without pausing product work.
Protect the critical path
Add tests around sign-in, billing, and the primary customer workflow.
Make release quality automatic
Require build, type-check, and tests in a single CI workflow.
Assign risk ownership
Document security reporting and ownership for the highest-risk modules.
DebtSignal uses visible repository evidence. It is a decision aid—not a security audit, code review, or replacement for engineering context.
Technical debt becomes expensive
when only engineers can explain it.
Make invisible risk discussable
Attach paths, controls, and repository evidence to every claim.
Connect debt to business outcomes
Frame work around incidents, release confidence, security, and speed.
Start with one bounded move
Give a small team a sequenced plan instead of an endless cleanup backlog.