independent code audit · code due diligence · no engineer required

You can read the P&L. Nobody has read the code.

Ascertify is an independent code audit for SaaS bought on Flippa, Acquire.com or TrustMRR, and apps built with Lovable, Cursor or an agency. It reads the repository without running it and shows what's exposed, what's missing, and what only the seller knows how to run. Every finding is pinned to a file and line, in plain English, before the money moves.

A read-only GitHub invite the seller can revoke, or a zip from the data room. JavaScript and TypeScript apps: Next.js, React, Node, Supabase, Firebase, Prisma.

No repo access yet? Scan the live product free:
No upload, no signup.

three questions the listing can't answer. the code can.

What does a code audit check before you buy a SaaS?

Whether the code is safe to own, whether what was built is real, and whether anyone but the seller can run it. The demo works and the revenue checks out. The problems live underneath, in files nobody opened before the listing went up, or before the invoice was sent. So we open them, and point at the exact lines.

Is it safe to own?

can anyone reach the customers' data, the keys, the database? Can the seller, after you take over?

Credentials committed to git history, databases open to the internet, admin keys shipped to every visitor's browser.

credential in git historyrow-level security disabled

What did you actually buy?

is it a product, or a template with a Stripe key?

Packages that don't exist in any registry, a database with nothing but default scaffolding, template code passed off as custom.

hallucinated dependencyschema has no real tables

Can anyone but the seller run it?

could a new developer, or you next month, pick this up and keep it running?

No setup instructions, no record of how the database is structured, a schema that exists only in the live system.

no setup instructionsno database migrations

our own data, not a vendor study

In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →

From black box to fix list in three steps.

01

Connect or upload

Point us at a GitHub repo or drop in a zip. Either way, nothing gets installed or run. We only read.

02

We read it, in plain English

Deterministic checks, no guesswork. Every finding is tied to a real file and line, with the exact snippet shown.

03

Fix it, negotiate it, or walk

Forward the PDF to the seller as a closing condition, hand it to your developer after transfer, or paste the findings into your AI tool and fix them yourself.

The checklist, in full, before you pay.

Every scan runs this exact list: deterministic checks, not impressions. Nothing on it requires you to trust our judgment, because every hit comes with the file and line that triggered it.

Is it safe to own?

  • Hardcoded secrets & API keys
  • SQL, NoSQL & shell command injection
  • Server-side request forgery (SSRF)
  • Open redirects & path traversal
  • eval() & unsafe deserialization
  • Weak crypto & disabled TLS checks
  • Cookie flags, CORS & security headers
  • JWT misuse & hardcoded signing secrets
  • Unfiltered Supabase queries
  • Firebase rules publicly open
  • Row-level security disabled
  • Service-role key in frontend code
  • Known CVEs in direct dependencies
  • Unsafe database migrations
  • Dangerous cascade deletes

What did you actually buy?

  • Dependencies that don't exist in any registry
  • Imports verified against the npm registry
  • Boilerplate ratio: template vs. custom code
  • Database schema with nothing but scaffolding
  • Test presence & coverage ratio

Can anyone but the seller run it?

  • README & setup instructions
  • npm scripts complete (dev, build)
  • Lockfile committed
  • .env.example present
  • Database migrations present
  • Circular dependencies
  • Code complexity hotspots
  • Code duplication
  • Unused or dead dependencies
  • Deprecated or abandoned dependencies
  • Missing foreign-key indexes

And every report lists what a static scan can't see: runtime behavior, whether your features actually work, performance under load. A clean result on this list is real, but it's never dressed up as more than it is.

findings that survive a defensive seller

Why can't the seller or the developer wave the findings away?

No vague grades, no “your app is risky.” Every finding is pinned to a line of real code: specific enough that “that's not an issue” needs an answer for that line, clear enough that you don't need a CTO to understand it.

Critical
Service-role key exposed in frontend code
src/lib/supabase.ts:14
Critical
Row-level security disabled on the users table
supabase/migrations/0007_init.sql:41
Likely AI-generated
Dependency that doesn't exist in any registry
package.json:28 · "react-auth-helper-pro"
4 more findings in the full report
The free preview tells you how many criticals exist. The full report shows you each one.Unlock the full report
your free preview looks like
3 critical security findings1 dependency that doesn't exist
Then you decide if the detail is worth $49.

One scan. One payment.

No subscription, no upsell loop. You need this at one moment (right before the wire, right before you ship, or right before you pay the final invoice), so it's priced as a single check. Run it again on the next deal or the next milestone, same one-time price.

You're about to wire real money for a codebase you've never opened, or you already paid for one. Knowing what's in it costs $49 while the first 50 last, $99 after.

$0

Free preview

A count of the critical findings in your code. Enough to know whether there's a problem worth raising, before you pay for the detail.

Run free preview
full report
$49
$99one-time

Every finding with file-and-line proof, the exact code, a plain-English explanation, a recommended first step, and a PDF you can forward to your developer.

Get full report ($49)

Don't trust us. Verify us.

Every claim below is one you can check yourself, which is the only kind of trust worth offering someone who's been burned before.

GitHub access, revocable anytime

Connecting a repo installs the Ascertify GitHub App with read-only access to only the repository you pick — never your whole account. You can uninstall it from your GitHub settings the moment the scan is done.

Your code is never executed

We read files as text: we never run your app, install its dependencies, or execute its tests. Each scan runs in an isolated sandbox and the code is deleted when it completes.

Every finding is evidence-anchored

No finding reaches your report without a real file, line, and snippet behind it. Deterministic tools find the risk first. Plain English only explains what's already there.

“Ascertify is the check I'd do by hand after 15+ years building for startups and agencies - automated, with the evidence attached, so you don't have to take anyone's word for it. Including mine.” Valentin Zuld, Founder, Ascertify · 15+ years in software · LinkedIn · Checks last updated: September 2026

Fair questions.

Is my code safe with you?
Your code is pulled into an isolated, network-disconnected sandbox, scanned, and deleted when the scan completes. We never run your code, never install its dependencies, and never build it. When you connect GitHub, you can see exactly what access you're granting and revoke it anytime from your GitHub settings. The report keeps only the findings and the specific snippets that prove them, not your codebase.
What stacks do you support?
JavaScript and TypeScript apps (Next.js, React, Node) with deep checks for Supabase, Firebase, and Prisma. That covers most AI-built apps today, and we have dedicated scans for apps built with Cursor and apps built with Lovable. Bubble, WordPress, Rails, and native mobile apps aren't supported yet, and the free preview will tell you your project isn't a fit before you pay, not after.

Do I need to know how to code?
No. That's the point. Every finding is explained in plain English: what it is, why it matters to your business, and what to do about it first. The technical evidence is attached for whoever does the fixing: your developer, or your AI tool.
What if the scan finds nothing critical?
Then the specific things we check came back clean, which is worth knowing, and the report lists exactly what those checks were. A clean result is not a certification that your app is secure; no static scan can honestly promise that. And the free preview shows your critical count before you pay, so you never buy a report blind.
Is this a penetration test?
No. A penetration test probes your live, running application. We read your code without ever running it, which catches a different class of problems (leaked keys, open database rules, missing pieces) with proof you can point to. Every report lists what we checked and what we didn't.
Can't I just paste my code into ChatGPT or Claude?
For fixing things, we encourage exactly that: the report is written to be pasted into your AI tool. Findingproblems is a different job. A chat model reads a sample of your code, gives different answers every run, and can both miss real issues and invent convincing ones. Our findings come from deterministic scanners that read every file and return the same result every time; AI is only used to translate proven findings into plain English. And if AI built your app, asking it to grade its own work isn't much of an audit.
How long does a scan take?
Most scans finish in a few minutes, and you watch the progress live. The free preview appears as soon as the scan completes; the full report and PDF are ready right after payment.
What if I'm not happy with the report?
The free preview exists so you never buy blind: you see your critical count before paying anything. If you buy the full report and it isn't useful, email support@ascertify.io within 7 days for a full refund. That policy is written into our terms, not just this page.
I fixed the findings — how do I verify the fixes?
Run a new scan. The free preview will show whether your critical count dropped to zero before you spend anything, and a fresh full report gives you updated evidence to keep on file: useful when signing off a milestone.
What exactly do I get?
Every finding with the file, line, and exact code that triggered it, a plain-English explanation of the risk, a recommended first step, and a shareable PDF. One-time payment, not a subscription.

Every finding is cheaper to know before the wire than after it.

The free preview takes a few minutes and tells you whether there's anything in the code worth negotiating over, or fixing before launch. Start there.

Scan the code, free to start

No install, no build, no run. Your code is sandboxed and deleted after the scan.