Understand an engineering estate before you bet on it.
Venkel scans every repository in a portfolio with deterministic open-source tools, normalizes the results into one evidence package, and gives decision-makers an executive read on the code, the practices and the team behind them. Source never leaves the machine it is scanned on.
Evidence first. Opinions clearly labelled.
The dataset
Findings, metrics, dependencies and people signals for every repository as portable JSONL plus an indexed SQLite database. Each record keeps the native scanner output beside the normalized value and links back to the raw artifact that produced it.
The report
One interactive HTML file with charts, sortable tables and a per-repository drill-down. It opens from a laptop with no network, prints to PDF, and separates facts from inferences from hypotheses on every card.
Executive findings
A frontier model reads the normalized package, never the code, and writes findings that cite their evidence. Key repositories get a deep dive through a bounded, redacted evidence accessor with a budget.
Four steps, all of them local.
Enumerate and clone
Your assistant lists the organization's repositories with your credentials, proposes a scope and depth per repository, and clones full history into an engagement directory. A read-only GitHub export captures pull requests, reviews, CI runs and deployments.
Scan
Pinned, checksummed scanners run as isolated subprocesses: scc, Trivy, Opengrep with our own rule set, gitleaks, Lizard, jscpd, git-sizer, plus git history analysis and native heuristics. No client tests or builds are ever executed.
Normalize and consolidate
Every output becomes findings, metrics, observations and dependencies with stable fingerprints, versioned severity maps and complete provenance. Runs are immutable and checksummed, and a second run diffs cleanly against the first.
Read, then dig
The report and the executive findings point at the repositories that matter: active, deployed, concentrated, or carrying the risk. Deep dives confirm or refute each hypothesis with cited snippets from the exact revision that was scanned.
Twelve lenses on every repository.
Built for other people's code.
Venkel was designed for due diligence and inherited estates, where the code is confidential and the people in the history are real. The constraints are structural, not policy.
- Local-first and offline by default. No scanner may touch the network during a scan; feeds are updated only with written approval.
- Client tests, builds and hooks are never executed.
- People analytics run in a named, pseudonymous or aggregate mode agreed in the engagement letter; small teams are protected from being singled out.
- Secrets are redacted at the source. Reports record where a credential sits, never what it is.
- Every number is traceable to a checksummed raw artifact. Coverage gaps are reported; an unscanned category is never shown as passing.
- Runs are immutable, retention is recorded in the package, and the deletion checklist is part of the runbook.
A fictional five-repository estate, scanned for real.
Example Co does not exist. Its repositories are Venkel's own test fixtures, with planted vulnerabilities, a fake credential, duplicated code and a few scaling anti-patterns, scanned with the production pipeline. Everything in the report is traceable to that run.
When the codebase is the asset.
Technical due diligence
Acquirers and investors who need quantified talking points on technology, maintenance, security and the team, in days, with the evidence attached.
Inherited estates
Engineering leaders taking over a hundred repositories who need to know which ones are alive, which ones are deployed, and which ones depend on a single person.
Modernization planning
Platform and architecture teams deciding what to consolidate, retire or rewrite, with scaling and error-handling risks ranked before the first deep dive.
Tell us about the estate.
How many repositories, where they live, and what decision the assessment has to inform. Venkel is delivered as an assessment engagement by Plausible Industries; the tool itself is available to clients on the download page.
Contact Plausible Industries