The Hidden Liabilities
Technical debt is a well-known concept: shortcuts taken today that create extra work tomorrow. A "Tech Debt Bomb" is a specific, severe form of technical debt that is currently invisible in day-to-day operations but will detonate — often catastrophically — under specific conditions like increased load, a key employee departure, or a dependency reaching end-of-life (EOL). These are the findings that change deal terms.
Common Tech Debt Bombs and How to Detect Them:
| Bomb Type | What It Looks Like | How to Detect It | Blast Radius |
|---|---|---|---|
| EOL Technology | App runs on Python 2.7, Java 8, Node 10, or CentOS 7 | Check runtime versions in Dockerfiles, CI configs, runtime.txt |
No security patches. Forced migration costing 6-18 months of engineering time |
| Single Point of Failure (SPOF) | One database server, one availability zone, one person who knows the deploy process | Ask: "What happens if us-east-1 goes down?" Watch their faces | Complete outage with no recovery path |
| Database Time Bomb | Primary key using 32-bit integer (INT) approaching max value (2,147,483,647), or tables with no indexes on columns used in WHERE clauses |
Run SELECT MAX(id) FROM users; and compare to INT max. Check EXPLAIN on common queries |
Application crashes or grinds to a halt at an unpredictable future date |
| The Manual Process | "Automated" processes that actually require human intervention | Ask to see the deployment runbook. If it's 47 steps long with notes like "ask Dave to restart the cache," it's manual | Deployments become impossible when key people leave |
| Vendor Lock-in | Critical business logic embedded in a proprietary platform (e.g., Salesforce Apex, Oracle stored procedures, a single cloud provider's proprietary services) | Review architecture diagrams for proprietary dependencies | Migration costs can exceed the acquisition price |
| Compliance Gaps | Handling PII or financial data without proper controls | Ask for their data flow diagram. Check if PII is encrypted at rest and in transit | Regulatory fines, mandatory breach disclosure, customer trust destruction |
The Strategy:
The key question is never "Does it work today?" The key question is: "What happens when conditions change?"
Specifically, ask these forcing-function questions during technical interviews:
- "What happens if traffic doubles overnight?" (Scalability)
- "What happens if your lead engineer gives two weeks' notice tomorrow?" (Knowledge distribution)
- "What happens if your primary database server fails at 3 AM on a Saturday?" (Disaster recovery)
- "When was the last time you restored from a backup? Did it work?" (Backup validity — untested backups are not backups)
If the target company can't answer these questions confidently — with evidence, not assurances — each unanswered question is a bomb with an unknown timer.
Key Point: The most dangerous tech debt bombs are the ones the target company doesn't know about. A company that says "we have significant tech debt in our authentication module" is actually demonstrating maturity — they're aware of their liabilities. A company that says "we have no tech debt" is either lying or lacks the engineering sophistication to recognize it. Both are red flags, but the latter is worse because it means the engineering culture cannot self-assess.