Sema's codebase scans assess product risks and compliance risks across code, cloud usage, engineering teams, security, open source, and Generative AI code.
2
Matt van Itallie argues that GenAI code should be treated much like open source: useful when reviewed and managed, but exposed to quality, security, intellectual property, and exit risks.
3
Technical findings become useful to executives when they are benchmarked against similar companies and translated into developer time, tooling costs, or business consequences.
Summary
Matt van Itallie explains how Sema evaluates codebases during technical due diligence and for ongoing engineering oversight. The scan covers code quality, development activity, developer retention, cloud spend, open source intellectual property risk, code security, cyber assets, and Generative AI code. He says the engineering team is often the most important part of the assessment because code needs the people who understand its context. Sema translates technical findings into scores, benchmarks, discussion questions, and estimated work or cost. Matt is positive about GenAI coding, while insisting that generated code must pass normal security and quality checks and receive extra code review. Sema's Generative AI Bill of Materials, or GBOM, separates GenAI-originated code from code that developers have modified. The conversation also covers trade secrets, copyright, open source licensing, and exit risk. Matt's advice changes with company stage: early startups should focus on product-market fit and staying in business before investing heavily in non-functional code improvements.
Sema scans the codebase and the organization around it
Matt van Itallie describes Sema's scan as a detailed and summary view of nonfunctional codebase requirements. It does not judge what a product does or whether it has product-market fit. It assesses whether the current team can maintain and expand the code, along with compliance risks that may concern lawyers or external stakeholders. The scan covers eight areas: code quality, development process, team composition, cloud spend and utilization, open source intellectual property risk, code security, a light cyber-assets review, and Generative AI code. He says the assessment is used mainly in technical due diligence, especially when investors are considering a company acquisition.
Developer knowledge can matter more than the code itself
Matt says subject matter expert developers are the most important part of codebase health. A buyer can acquire a finished novel without its novelist, but code is never finished because teams keep adding features, upgrades, and patches. Sema checks developer-by-developer activity and whether important people remain in the business. The scan uses version-control history, including changes over time and commits across repositories. Sema's automatic rule assumes that a coder who changed code within the last 90 days is still present. Matt is clear that this is only a starting point, since an engineering manager may stop coding and someone who recently committed may have left.
Cloud cost analysis starts with a short setup and can estimate savings
For cloud cost optimization, Matt says Sema first analyzes historical cloud spending and usage after about an hour of setup. A deeper review can combine that data with customer information to estimate the cost or profitability contribution of individual accounts. The initial result shows spending trends, the maturity of the company's cloud usage, and a rough estimate of possible savings. Some changes are quick, while others require engineering work. Matt says the scan does not simply flip a switch to make every improvement. He also describes the output as useful for boards because it connects technical decisions with the business impact of cloud infrastructure.
Sema turns technical measurements into scores, context, and questions
Sema translates many measurements into a score from 1 to 100 so that CEOs and board members can understand the overall state of a codebase. Matt says the company spent about five years collecting data before settling on its weighting. Line-level warnings count for less than 1 percent because linting does not determine whether software can deliver business outcomes. Developer retention accounts for 25 points. The scan can examine unit-test coverage, duplicate code, complexity, and signs that a repository needs refactoring, but Matt says code cannot be reduced entirely to metrics. The report adds discussion questions because some findings need human review.
GenAI code needs the same controls as open source, with extra review
Matt is strongly in favor of using GenAI code, especially because it can improve developer throughput and satisfaction. He says generated code must still go through quality gates, security scans, and code review. Teams normally use open source without reviewing every line, but generated code is different because the team prompted the model and needs to check whether the result fits its context. Sema measures how much code originated with GenAI and whether a developer modified it. Matt distinguishes pure GenAI code, which is left untouched from the prompt, from blended code that a developer has changed. Pure generated code may be acceptable for a prototype, but untouched code in a production system is a serious warning sign.
Matt introduces Sema's Generative AI Bill of Materials, or GBOM, as an extension of the Software Bill of Materials idea. An SBOM shows how much open source code is present. A GBOM estimates how much code originated from Generative AI and how safely it is being used. The assessment distinguishes code that came directly from a prompt from code that a developer has blended into the codebase. Matt says the more serious the use case, the more developers should edit the generated output line by line. Sema's approach treats GenAI-originated code as a source of measurable risk rather than assuming that the tool or the developer's intent makes it safe.
GenAI introduces several forms of intellectual property risk
Matt separates intellectual property concerns into patent protection, trade secrets, copyright, and infringement. He says patent protection should generally concern the idea rather than the generated text, while trade-secret risk arises when company code is entered into tools without suitable commercial or enterprise protections. Free tools can train on what users enter, which Matt compares to posting secret code on the internet. Copyright protection for generated code is less clear because copyright applies to the work itself, so he advises companies to consult their lawyers. Open source licensing is another concern. Directly using an open source package creates a clearer risk than using code that may have passed indirectly through a model's training data.
GenAI can reduce a technology moat, while helping companies build faster
Matt calls exit risk the possibility that an investor or buyer decides it can reproduce a company's technology with AI instead of acquiring the company. He says this is especially relevant for generic analytics or prototype products that large language models can build quickly. A company with customers and a strong brand may still have value because buyers may be acquiring the business and its revenue rather than the code. Custom, context-specific code is harder to reproduce than generic generated code. Matt presents the tradeoff plainly: GenAI can make a product less defensible while also helping a company reach production and revenue sooner.
"The more contextualized and specific to the problem you're solving, the more valuable that technology is relative to building it from scratch."Matt van Itallie52:46
Who should watch
You are preparing technical due diligence for an acquisition or investment and need a way to explain engineering risks to non-technical stakeholders.
Your engineering team uses GenAI coding tools and you need practical guidance on code review, licensing, trade secrets, and production risk.
You lead a young startup and want to decide when code quality, testing, security, and process work should take priority over product-market fit.
