Acquire.com approves about 13% of the startups that apply to list, and a vetted listing means real revenue, real customers and clean financials. It doesn't mean anyone opened the code. The codebase is the asset that actually transfers at closing. Ascertify reads it between the LOI and the wire and tells you, in plain English with file-and-line proof, what you'd actually own.
Read-only repo invite or a zip from the data room. We read the code. We never run it.
This package doesn't exist in any public registry. It's a hallmark of AI-generated code, which invents plausible-sounding dependencies. At best, the project can't be installed cleanly by the next developer. At worst, someone publishes a malicious package under that exact name and your app pulls it in.
Acquire.com says it approves about 13% of submissions, and it asks every listing for real revenue, real customers and clean financials. Connected metrics from Stripe, ChartMogul or Baremetrics show buyers customers, ARR and growth in real time. None of that touches the repository.
Ascertify is an independent static code audit for SaaS acquisitions on Acquire.com. It scans the codebase of the business you're buying, without ever executing it, and reports what it finds in plain English with the exact file and line as evidence. One scan, one payment: $49 for the first 50 scans, then $99. The free preview shows the critical-finding count before you pay. Not a penetration test, and not affiliated with Acquire.com.
the liabilities transfer with the repo, not the contract
Live credentials in git history the seller can still use after transfer, admin keys shipped to every visitor's browser, database rules open to the internet.
real MRR can sit on top of a codebase that's mostly template
Dependencies invented by an AI, a database schema with nothing but default scaffolding, most of the code committed in one dump right before listing.
the handover call ends. then it's just you and the repo
No setup instructions, no record of the database structure, no tests. If only the seller can operate it, you bought their job, not their business.
Acquire.com has published two guides on this. “Can You Do Technical Due Diligence Without Being a Coder?” opens with “Yes… not in every acquisition,” then tells you to quiz the founder, list the tech stack, shadow the release process, read the repository history, check third-party dependencies and confirm IP agreements. “How to Do Technical Due Diligence on a SaaS Startup” adds a software composition analysis report and security standards, and ends by telling you to hire an agency: “They're expensive but worth it.” Neither guide names one.
| acquire.com's guides say to check | what the scan does |
|---|---|
| Quiz the founder on the stack; shadow the release process | Not covered. That's a conversation. The report gives you the questions to ask in it. |
| Read the repository history: who authored it, who contributed, when | Not covered as history. The scan reads the code as delivered and flags what shouldn't be in it, not who wrote it. |
| Check third-party dependencies; ask for a software composition analysis report | Covered in part: dependencies that don't exist in any registry, which is the failure AI-built listings actually have. Licence compliance and vendor sunsets are your call. |
| Security: ISO/IEC 27001 alignment, code review process | Not covered as a standard. Covered as facts: live credentials in the codebase, admin keys shipped to the browser, Supabase row-level security and Firebase rules left open. |
| Documentation, technical manuals, user guides | Covered in part: setup instructions and a record of the database structure, the two things the next developer needs on day one. |
| IP agreements with employees and contractors | Not covered. That's paperwork, not code. Ask the seller for signed assignments. |
Both guides end the same way: if you can't read the code, hire someone who can, and expect it to be expensive. For the code layer on its own, Ascertify is $49 while the first 50 scans last, $99 after, and takes minutes, on a marketplace where its own report says SaaS closes at a median 3.9× profit after an average 81 days on the market. Everything else those guides list is on our SaaS technical due diligence checklist, marked by what the scan covers and what stays yours to ask.
our own data, not a vendor study
In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →
Acquire.com's closing flow runs NDA, data room, LOI, due diligence, purchase agreement, escrow. The scan sits in the due diligence step, after the LOI and before the wire. You already request financials, metrics and the customer list there. Add one ask.
Acquire.com's own guide tells you to read the repository. Ask for read-only access: a GitHub invite the seller can revoke after the scan, or a zip in the data room. Serious sellers say yes. A refusal is a finding in itself.
Deterministic checks, no guesswork. Every finding is pinned to a real file and line with the exact snippet shown, translated into what it means for the deal.
Clean report: close with confidence. Findings: make fixes and credential rotation conditions of closing, adjust the price, or walk before the funds release, not after.
No vague grades. Every finding is pinned to a line of real code: specific enough that “that's not an issue” doesn't survive contact with it, clear enough that you don't need a CTO to understand it.
SaaS on Acquire.com sold at a median 3.9× profit in both 2024 and 2025. One scan, one payment. Run it during diligence, use it at the negotiating table, done. The pricing page sets it against the $500 to $5,000 alternatives.
You're about to wire 3.9× a year's profit for a codebase you've never opened. Knowing what's in it costs $49 while the first 50 last, $99 after.
Free preview
A count of the critical findings in the code. Enough to know whether there's a problem worth raising, before you pay for the detail.
Get the free previewEvery finding with file-and-line proof, the exact code, a plain-English explanation of what it means for the deal, and a PDF you can put in front of the seller.
Get full report ($49)This is one layer of SaaS due diligence: the technical asset. It doesn't check churn, customer concentration, traffic quality, or the seller's claims about anything but the code. It's a static review, not a penetration test, and a clean result is not a certification. We report what we can prove: the file, the line, and the exact code. Ascertify is independent and not affiliated with Acquire.com or any marketplace.
the message to send the seller
Before funds release, I'd like to run an independent static code audit on the repository. It reads the code without running it, installs nothing, and the code is deleted after the scan. Could you add me as a read-only collaborator on the repo for 48 hours? Revoke it as soon as the scan completes. If a zip in the data room is easier, that works too.
A serious seller says yes, because a clean report helps them close. A seller who refuses read-only access before you wire has handed you a finding for free. Once you have access, use GitHub's Download ZIP on the repository and upload that zip. The GitHub connect option needs admin rights on the repo, which a collaborator invite does not give you.
Sources, as published by Acquire.com on 5 Sep 2026: Acquire.com, How Acquire.com Works: Sell Your Startup or Buy One; Acquire.com, Can You Do Technical Due Diligence Without Being a Coder?; Acquire.com, How to Do Technical Due Diligence on a SaaS Startup; Acquire.com, Biannual Acquisition Multiples Report (Jan 2026); Acquire.com Help, connecting customer metrics via ChartMogul.
Every marketplace verifies the business and none of them read the code. The scan is the same wherever the listing lives; the SaaS due diligence overview explains what it covers.
The free preview takes minutes and tells you whether there's anything in the code worth negotiating over. Start there.
Scan the code, free to startRead-only access. The code is sandboxed, never executed, and deleted after the scan.