Code due diligence for a micro-SaaS means reading the repository you are about to buy, the way you read the P&L, before the money moves. Flippa, Acquire.com and TrustMRR verify revenue, traffic and the seller's identity. None of them open the code. Ascertify is an independent code audit for SaaS bought on Flippa, Acquire.com or TrustMRR: it reads the code without running it, installs nothing, and reports what is exposed, what looks unfinished or AI-generated, and what only the seller knows how to run.
You do not need to read code to use it. Ask the seller for a read-only GitHub invite or a zip from the data room, upload it, and the free preview counts the criticals. The full report pins every finding to a file and line, in plain English, for $49 while the first 50 scans last, $99 after. Check it yourself, send it to the seller, or hand it to the developer who inherits the product.
A read-only GitHub invite the seller can revoke, or a zip from the data room. Read-only, never run, deleted after the scan.
the listing is vetted. the repository is not.
SaaS marketplaces have become much better at verifying revenue and business metrics. That is useful, but it is a different job from checking the software you are actually buying.
“I can pressure-test the P&L and add-backs fine. What I can't see before signing is whether the tech itself is a liability” a buyer on Reddit, 2026
| marketplace | what they verify | what their own guidance says about code |
|---|---|---|
| Flippa | Revenue and traffic through integrations; paid due diligence reports at $1,500 to $2,500 | Its SaaS buyer guide asks for read-only repo access or a supervised walkthrough. Flippa also has a partner directory, but it does not list a dedicated code-review provider. |
| Acquire.com | Metrics through connected Stripe and analytics accounts; due diligence workflow and task lists | Its technical due diligence guide, updated August 2026, tells buyers to “get professional help”, noting that it can be “expensive but worth it.” It does not name a provider. |
| TrustMRR | Revenue through Stripe, RevenueCat and supported integrations | Revenue is verified frequently, but there is no equivalent repository-level code review. |
| Empire Flippers / Microns | Revenue, expenses, seller identity and business operations | Technical review is left to the buyer, with general advice to involve developers or technical specialists. |
Acquire.com's own guide on technical due diligence for SaaS acquisitions explicitly recommends professional technical help. Flippa's SaaS due diligence guide goes as far as telling buyers to request repository access.
None of these marketplaces includes repository-level code review in the standard verification flow. More importantly for a buyer without a technical team, the advice usually ends at some version of “get a developer to look at it.” Ascertify is built for the step after that sentence.
our own data, not a vendor study
In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →
three questions the listing can't answer. the code can.
A useful code review before acquisition should answer three buyer questions: what are you inheriting, is the product really there, and can somebody else run it after the seller leaves. As a buyer on Reddit put it in 2026, “Revenue proves demand but code quality proves durability.”
The checks below map directly to those questions. They run on JavaScript and TypeScript apps: Next.js, React, Node, Supabase, Firebase, Prisma.
Not just the product. The technical baggage attached to it.
A listing can show MRR, churn and screenshots while saying nothing about credentials left in git history, an open database or dependencies with known vulnerabilities. After closing, those become your credentials, your infrastructure and your repair bill.
allow read, write: if true matters.Or a demo that happens to survive the sales call?
AI-assisted development is not a problem by itself. The problem is software that looks complete from the outside but contains generated or unfinished code nobody properly validated.
Read more about how to tell whether a SaaS appears AI-generated or unfinished.
Assume the seller disappears after handover.
Could a competent developer understand the setup, reconstruct the database, deploy a new environment and change the product without calling the founder? If not, you are also buying dependency on one person's undocumented knowledge.
See how to judge whether you can maintain the codebase after acquisition, or use the full technical due diligence checklist for SaaS buyers. If the target was built with Lovable, see the Lovable security report.
Ascertify does not perform penetration testing, runtime security testing, financial verification or legal due diligence. We inspect the static codebase. We do not execute the application.
between the loi and the wire
Four steps, none of which need a developer. Technical due diligence for a small SaaS should not turn a modest acquisition into a consulting engagement of its own.
Ask the seller for a read-only GitHub invitation or a repository archive from the data room, after the LOI and before funds release. The exact message is below.
The timing here depends mostly on the seller.
Connect the repository or upload the zip. The free preview tells you how many critical findings were detected before you purchase the full report.
The full audit costs $49 while the first 50 scans last, $99 after. Every finding includes the file, line, relevant code snippet, a plain-English explanation of why it matters and what needs to change.
Your secret database admin key is sitting in code that ships to the browser. It bypasses every access rule you have. Anyone who opens your site can read or change all of your data.
Send the report to the seller and decide what the finding actually means for the acquisition. You might ask for a fix before closing, renegotiate, get a remediation estimate from a developer, accept a minor issue, or walk away if the risk changes the deal.
See how the scan fits into an Acquire.com acquisition, Flippa purchase or TrustMRR deal.
copy, paste, send
Before funds release, I'd like to run an independent static code audit on the repository. It reads the code without running it, installs nothing, and the code is deleted after the scan. Could you add me as a read-only collaborator on the repo for 48 hours? Revoke it as soon as the scan completes. If a zip in the data room is easier, that works too.
A serious seller says yes, because a clean report helps them close. A seller who refuses read-only access before you wire has handed you a finding for free. Once you have access, use GitHub's Download ZIP on the repository and upload that zip. The GitHub connect option needs admin rights on the repo, which a collaborator invite does not give you.
Repositories are handled in a sandboxed environment, never run and deleted after the scan.
Traditional technical due diligence was built for larger acquisitions. That pricing can become difficult to justify when the entire SaaS costs $10,000 or $20,000.
| option | price | turnaround | reads the code? |
|---|---|---|---|
| Do it yourself | Free, plus 4 to 6 hours | Same day | Yes, if you are a developer |
| Ascertify | $49 (first 50 scans, then $99) | Same day | Yes, with file-and-line evidence |
| Freelance developer review | ~€500 to €2,000 | 3 to 7 days | Yes, scope varies |
| BuildScore Full Audit | $1,499 | 48 hours | Yes, with human analysts |
| Flippa Due Diligence report | $1,500 to $2,500 | Not stated | No, primarily financial and traffic DD |
| WebAcquisition micro-SaaS DD | $2,900+ | 7 business days | No |
| Agency technical DD | $3,000 to $8,000+ | 1 to 2 weeks | Yes, broader scope |
For a six-figure acquisition, a multi-thousand-dollar technical review may be completely reasonable. For a $12,000 micro-SaaS, spending several thousand dollars just to inspect the code is harder to justify.
Ascertify deliberately has a narrower scope. It checks the repository for acquisition-relevant technical risk and gives the buyer evidence that can be used during the deal.
The full report is $49 while the first 50 scans last, $99 after, with a 7-day refund in the terms. What the report contains, and how it compares line by line, is on the pricing page.
Each page covers what that marketplace verifies, where the code check fits in its deal flow, and what to ask the seller.
Buying directly, or through Microns, ExitBid or SideProjectors? The scan works the same way regardless of where the deal originated. Bring the technical due diligence checklist to the call, then upload the repository for a scan →
Yes. That is who Ascertify is for.
Most micro-SaaS due diligence advice eventually reaches the same instruction: have a developer inspect the code. That is not especially useful if you do not have one. Ascertify explains findings in buyer language first, while keeping the technical evidence underneath for whoever eventually needs to fix the issue.
Read the non-technical buyer's guide to technical due diligence.
Ask for read-only repo access before the walkthrough. A walkthrough shows you what the seller chooses to demonstrate, while repository access allows the underlying code to be inspected independently.
A zip from the data room is also fine if the seller does not want to grant direct GitHub access. Ask after the LOI, before funds release, when you have both access and leverage. The exact message to send is on this page under the process section.
The repository can provide evidence, but code ownership is partly a legal question. Check contractor and employee IP assignments, third-party licences and how much of the application comes from templates or external boilerplate.
Ascertify can surface technical evidence relevant to that review, but it does not replace legal diligence. See how to check whether the seller owns the code.
Not by itself. AI-generated code matters when concrete failure modes show up in the repository, such as hallucinated dependencies, unfinished logic, inconsistent implementation, no tests, or an entire application appearing in one large commit shortly before sale.
Those are maintainability problems regardless of whether the code was written by a developer, Copilot, Claude or anything else.
A repository zip from the data room works too. A seller can have reasonable reasons for avoiding direct GitHub access before the LOI, so an early no is not automatically suspicious.
Refusing both read-only access and a repository archive after the LOI, before you wire, is different. At that point you are being asked to buy software while being prevented from inspecting the software. A serious seller says yes, because a clean report helps them close.
They can dispute the interpretation. The underlying evidence is harder to wave away.
Each Ascertify finding identifies the file, line and relevant snippet. Instead of saying “the authentication looks insecure,” the report points to the exact code creating the problem. Sellers can argue with an opinion much more easily than they can argue that line 47 does not exist.
Ascertify does not perform penetration testing, execute the application, verify runtime behaviour, audit financial statements or give legal advice.
Use marketplace verification, accountants and legal counsel for those parts of the acquisition. Use Ascertify when you want someone to inspect the code you are actually buying.
You do not need an enterprise diligence project for every micro-SaaS acquisition. You do need to know whether the repository contains something that materially changes what you are buying.
Start with the free preview. The full code audit is $49 while the first 50 scans last, $99 after, and gives you file-and-line evidence for every finding.
Independent service. Not affiliated with Acquire.com, Flippa, TrustMRR or any other marketplace.