micro-saas code due diligence · no engineer required

Every marketplace verifies the business. None of them read the code.

Code due diligence for a micro-SaaS means reading the repository you are about to buy, the way you read the P&L, before the money moves. Flippa, Acquire.com and TrustMRR verify revenue, traffic and the seller's identity. None of them open the code. Ascertify is an independent code audit for SaaS bought on Flippa, Acquire.com or TrustMRR: it reads the code without running it, installs nothing, and reports what is exposed, what looks unfinished or AI-generated, and what only the seller knows how to run.

You do not need to read code to use it. Ask the seller for a read-only GitHub invite or a zip from the data room, upload it, and the free preview counts the criticals. The full report pins every finding to a file and line, in plain English, for $49 while the first 50 scans last, $99 after. Check it yourself, send it to the seller, or hand it to the developer who inherits the product.

A read-only GitHub invite the seller can revoke, or a zip from the data room. Read-only, never run, deleted after the scan.

the listing is vetted. the repository is not.

What do Flippa, Acquire.com and TrustMRR actually verify?

SaaS marketplaces have become much better at verifying revenue and business metrics. That is useful, but it is a different job from checking the software you are actually buying.

“I can pressure-test the P&L and add-backs fine. What I can't see before signing is whether the tech itself is a liability” a buyer on Reddit, 2026
marketplacewhat they verifywhat their own guidance says about code
FlippaRevenue and traffic through integrations; paid due diligence reports at $1,500 to $2,500Its SaaS buyer guide asks for read-only repo access or a supervised walkthrough. Flippa also has a partner directory, but it does not list a dedicated code-review provider.
Acquire.comMetrics through connected Stripe and analytics accounts; due diligence workflow and task listsIts technical due diligence guide, updated August 2026, tells buyers to “get professional help”, noting that it can be “expensive but worth it.” It does not name a provider.
TrustMRRRevenue through Stripe, RevenueCat and supported integrationsRevenue is verified frequently, but there is no equivalent repository-level code review.
Empire Flippers / MicronsRevenue, expenses, seller identity and business operationsTechnical review is left to the buyer, with general advice to involve developers or technical specialists.

Acquire.com's own guide on technical due diligence for SaaS acquisitions explicitly recommends professional technical help. Flippa's SaaS due diligence guide goes as far as telling buyers to request repository access.

None of these marketplaces includes repository-level code review in the standard verification flow. More importantly for a buyer without a technical team, the advice usually ends at some version of “get a developer to look at it.” Ascertify is built for the step after that sentence.

our own data, not a vendor study

In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →

three questions the listing can't answer. the code can.

What does a code audit check before you buy a micro-SaaS?

A useful code review before acquisition should answer three buyer questions: what are you inheriting, is the product really there, and can somebody else run it after the seller leaves. As a buyer on Reddit put it in 2026, “Revenue proves demand but code quality proves durability.”

The checks below map directly to those questions. They run on JavaScript and TypeScript apps: Next.js, React, Node, Supabase, Firebase, Prisma.

What do you inherit?

Not just the product. The technical baggage attached to it.

A listing can show MRR, churn and screenshots while saying nothing about credentials left in git history, an open database or dependencies with known vulnerabilities. After closing, those become your credentials, your infrastructure and your repair bill.

  • Live credentials in git history. API keys and secrets can remain recoverable even after the seller removes them from the current files. See why secrets in repository history matter during an acquisition.
  • Service-role or admin keys in frontend code. Privileged credentials may be visible to every user. See what an exposed service-role key means.
  • Open Firebase or Firestore rules. Database rules may allow unauthenticated reads or writes. See why allow read, write: if true matters.
  • Supabase RLS disabled. Tables may depend entirely on application code for access control.
  • Injection and request-forgery paths. User input that reaches a database query, a shell command, a redirect, a file path or a server-side request, traced from where it enters to where it lands.
  • Known-vulnerable dependencies. Packages are checked against known vulnerability data such as OSV.
  • License conflicts. Third-party licences may not fit the way a proprietary commercial product is being distributed.

Is the product real?

Or a demo that happens to survive the sales call?

AI-assisted development is not a problem by itself. The problem is software that looks complete from the outside but contains generated or unfinished code nobody properly validated.

  • Hallucinated or non-existent packages. Dependencies referenced by the code may not exist or may never have been installable.
  • Thin database schema. A supposed SaaS product may contain little beyond authentication boilerplate and a few placeholder tables.
  • Single-dump commit history. If the entire application appears in one large commit shortly before the listing, it deserves a closer look.
  • Boilerplate and template dependency. We look at how much of the repository appears product-specific versus generic scaffolding.
  • Placeholder or unfinished implementation. Interfaces may exist while the underlying feature is incomplete or disconnected.

Read more about how to tell whether a SaaS appears AI-generated or unfinished.

Can you run it without them?

Assume the seller disappears after handover.

Could a competent developer understand the setup, reconstruct the database, deploy a new environment and change the product without calling the founder? If not, you are also buying dependency on one person's undocumented knowledge.

  • Build instructions. Can a new developer understand how the application is assembled?
  • .env.example coverage. Are required environment variables documented without exposing the secrets themselves?
  • Missing database migrations. Can the production schema actually be reconstructed?
  • Tests. Are meaningful automated tests present at all?
  • Documentation and bus factor. How much critical knowledge appears to live only with the seller?
  • Stale or abandoned stack. Important frameworks or dependencies may already be difficult to maintain.
  • Unsafe migration patterns. Database changes may carry an unnecessary risk of damaging production data.

See how to judge whether you can maintain the codebase after acquisition, or use the full technical due diligence checklist for SaaS buyers. If the target was built with Lovable, see the Lovable security report.

Ascertify does not perform penetration testing, runtime security testing, financial verification or legal due diligence. We inspect the static codebase. We do not execute the application.

between the loi and the wire

How do I audit the code if I can't read it?

Four steps, none of which need a developer. Technical due diligence for a small SaaS should not turn a modest acquisition into a consulting engagement of its own.

01usually same day

Get access

Ask the seller for a read-only GitHub invitation or a repository archive from the data room, after the LOI and before funds release. The exact message is below.

The timing here depends mostly on the seller.

02minutes

Upload

Connect the repository or upload the zip. The free preview tells you how many critical findings were detected before you purchase the full report.

03same day

Get the full report

The full audit costs $49 while the first 50 scans last, $99 after. Every finding includes the file, line, relevant code snippet, a plain-English explanation of why it matters and what needs to change.

04your call

Use it in the deal

Send the report to the seller and decide what the finding actually means for the acquisition. You might ask for a fix before closing, renegotiate, get a remediation estimate from a developer, accept a minor issue, or walk away if the risk changes the deal.

See how the scan fits into an Acquire.com acquisition, Flippa purchase or TrustMRR deal.

copy, paste, send

The message to send the seller

Before funds release, I'd like to run an independent static code audit on the repository. It reads the code without running it, installs nothing, and the code is deleted after the scan. Could you add me as a read-only collaborator on the repo for 48 hours? Revoke it as soon as the scan completes. If a zip in the data room is easier, that works too.

A serious seller says yes, because a clean report helps them close. A seller who refuses read-only access before you wire has handed you a finding for free. Once you have access, use GitHub's Download ZIP on the repository and upload that zip. The GitHub connect option needs admin rights on the repo, which a collaborator invite does not give you.

Repositories are handled in a sandboxed environment, never run and deleted after the scan.

How much does technical due diligence cost for a small SaaS?

Traditional technical due diligence was built for larger acquisitions. That pricing can become difficult to justify when the entire SaaS costs $10,000 or $20,000.

optionpriceturnaroundreads the code?
Do it yourselfFree, plus 4 to 6 hoursSame dayYes, if you are a developer
Ascertify$49 (first 50 scans, then $99)Same dayYes, with file-and-line evidence
Freelance developer review~€500 to €2,0003 to 7 daysYes, scope varies
BuildScore Full Audit$1,49948 hoursYes, with human analysts
Flippa Due Diligence report$1,500 to $2,500Not statedNo, primarily financial and traffic DD
WebAcquisition micro-SaaS DD$2,900+7 business daysNo
Agency technical DD$3,000 to $8,000+1 to 2 weeksYes, broader scope

For a six-figure acquisition, a multi-thousand-dollar technical review may be completely reasonable. For a $12,000 micro-SaaS, spending several thousand dollars just to inspect the code is harder to justify.

Ascertify deliberately has a narrower scope. It checks the repository for acquisition-relevant technical risk and gives the buyer evidence that can be used during the deal.

The full report is $49 while the first 50 scans last, $99 after, with a 7-day refund in the terms. What the report contains, and how it compares line by line, is on the pricing page.

Which marketplace are you buying on?

Each page covers what that marketplace verifies, where the code check fits in its deal flow, and what to ask the seller.

Buying directly, or through Microns, ExitBid or SideProjectors? The scan works the same way regardless of where the deal originated. Bring the technical due diligence checklist to the call, then upload the repository for a scan →

Fair questions

Can I do technical due diligence if I'm not a developer?

Yes. That is who Ascertify is for.

Most micro-SaaS due diligence advice eventually reaches the same instruction: have a developer inspect the code. That is not especially useful if you do not have one. Ascertify explains findings in buyer language first, while keeping the technical evidence underneath for whoever eventually needs to fix the issue.

Read the non-technical buyer's guide to technical due diligence.

What should I ask the seller for, repo access or a walkthrough?

Ask for read-only repo access before the walkthrough. A walkthrough shows you what the seller chooses to demonstrate, while repository access allows the underlying code to be inspected independently.

A zip from the data room is also fine if the seller does not want to grant direct GitHub access. Ask after the LOI, before funds release, when you have both access and leverage. The exact message to send is on this page under the process section.

How do I know the seller actually owns the code?

The repository can provide evidence, but code ownership is partly a legal question. Check contractor and employee IP assignments, third-party licences and how much of the application comes from templates or external boilerplate.

Ascertify can surface technical evidence relevant to that review, but it does not replace legal diligence. See how to check whether the seller owns the code.

Does it matter if the SaaS was vibe-coded or AI-generated?

Not by itself. AI-generated code matters when concrete failure modes show up in the repository, such as hallucinated dependencies, unfinished logic, inconsistent implementation, no tests, or an entire application appearing in one large commit shortly before sale.

Those are maintainability problems regardless of whether the code was written by a developer, Copilot, Claude or anything else.

What if the seller refuses repo access?

A repository zip from the data room works too. A seller can have reasonable reasons for avoiding direct GitHub access before the LOI, so an early no is not automatically suspicious.

Refusing both read-only access and a repository archive after the LOI, before you wire, is different. At that point you are being asked to buy software while being prevented from inspecting the software. A serious seller says yes, because a clean report helps them close.

Will the seller dispute the findings?

They can dispute the interpretation. The underlying evidence is harder to wave away.

Each Ascertify finding identifies the file, line and relevant snippet. Instead of saying “the authentication looks insecure,” the report points to the exact code creating the problem. Sellers can argue with an opinion much more easily than they can argue that line 47 does not exist.

What don't you check?

Ascertify does not perform penetration testing, execute the application, verify runtime behaviour, audit financial statements or give legal advice.

Use marketplace verification, accountants and legal counsel for those parts of the acquisition. Use Ascertify when you want someone to inspect the code you are actually buying.

Every finding is cheaper to know before the wire than after it.

You do not need an enterprise diligence project for every micro-SaaS acquisition. You do need to know whether the repository contains something that materially changes what you are buying.

Start with the free preview. The full code audit is $49 while the first 50 scans last, $99 after, and gives you file-and-line evidence for every finding.

Independent service. Not affiliated with Acquire.com, Flippa, TrustMRR or any other marketplace.