acquire.com due diligence · the code layer, before escrow

You've read the P&L. Nobody's read the code.

Acquire.com approves about 13% of the startups that apply to list, and a vetted listing means real revenue, real customers and clean financials. It doesn't mean anyone opened the code. The codebase is the asset that actually transfers at closing. Ascertify reads it between the LOI and the wire and tells you, in plain English with file-and-line proof, what you'd actually own.

The business: vetted
Revenue, metrics, seller identity. Marketplace territory.
The code: taken on faith
The asset itself. That's the gap this scan closes.

Read-only repo invite or a zip from the data room. We read the code. We never run it.

What does Acquire.com vet, and what doesn't it?

Acquire.com says it approves about 13% of submissions, and it asks every listing for real revenue, real customers and clean financials. Connected metrics from Stripe, ChartMogul or Baremetrics show buyers customers, ARR and growth in real time. None of that touches the repository.

Acquire.com vets
  • Seller identity, and a listing that fits its criteria
  • Real revenue, real customers, clean financials
  • Connected metrics: customers, ARR and growth rate, when the seller links Stripe, ChartMogul or Baremetrics
  • The closing workflow: NDA, data room, LOI, purchase agreement, escrow through its closing partners
Nobody at Acquire.com verifies
  • Whether the dependencies in package.json exist
  • Whether live credentials sit in the codebase
  • Whether database rules are open to the internet
  • Whether anyone but the founder can run the thing
  • Any metrics at all, when the seller skips the optional connection

Ascertify is an independent static code audit for SaaS acquisitions on Acquire.com. It scans the codebase of the business you're buying, without ever executing it, and reports what it finds in plain English with the exact file and line as evidence. One scan, one payment: $49 for the first 50 scans, then $99. The free preview shows the critical-finding count before you pay. Not a penetration test, and not affiliated with Acquire.com.

What can the code tell you that the data room can't?

What do you inherit?

the liabilities transfer with the repo, not the contract

Live credentials in git history the seller can still use after transfer, admin keys shipped to every visitor's browser, database rules open to the internet.

committed live credentialrow-level security disabled

Is the product real?

real MRR can sit on top of a codebase that's mostly template

Dependencies invented by an AI, a database schema with nothing but default scaffolding, most of the code committed in one dump right before listing.

hallucinated dependencyschema has no real tables

Can you run it without them?

the handover call ends. then it's just you and the repo

No setup instructions, no record of the database structure, no tests. If only the seller can operate it, you bought their job, not their business.

no setup instructionsno database migrations

What do Acquire.com's own guides say to check in the code?

Acquire.com has published two guides on this. “Can You Do Technical Due Diligence Without Being a Coder?” opens with “Yes… not in every acquisition,” then tells you to quiz the founder, list the tech stack, shadow the release process, read the repository history, check third-party dependencies and confirm IP agreements. “How to Do Technical Due Diligence on a SaaS Startup” adds a software composition analysis report and security standards, and ends by telling you to hire an agency: “They're expensive but worth it.” Neither guide names one.

acquire.com's guides say to checkwhat the scan does
Quiz the founder on the stack; shadow the release processNot covered. That's a conversation. The report gives you the questions to ask in it.
Read the repository history: who authored it, who contributed, whenNot covered as history. The scan reads the code as delivered and flags what shouldn't be in it, not who wrote it.
Check third-party dependencies; ask for a software composition analysis reportCovered in part: dependencies that don't exist in any registry, which is the failure AI-built listings actually have. Licence compliance and vendor sunsets are your call.
Security: ISO/IEC 27001 alignment, code review processNot covered as a standard. Covered as facts: live credentials in the codebase, admin keys shipped to the browser, Supabase row-level security and Firebase rules left open.
Documentation, technical manuals, user guidesCovered in part: setup instructions and a record of the database structure, the two things the next developer needs on day one.
IP agreements with employees and contractorsNot covered. That's paperwork, not code. Ask the seller for signed assignments.

Both guides end the same way: if you can't read the code, hire someone who can, and expect it to be expensive. For the code layer on its own, Ascertify is $49 while the first 50 scans last, $99 after, and takes minutes, on a marketplace where its own report says SaaS closes at a median 3.9× profit after an average 81 days on the market. Everything else those guides list is on our SaaS technical due diligence checklist, marked by what the scan covers and what stays yours to ask.

our own data, not a vendor study

In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →

When in an Acquire.com deal should you run a code audit?

Acquire.com's closing flow runs NDA, data room, LOI, due diligence, purchase agreement, escrow. The scan sits in the due diligence step, after the LOI and before the wire. You already request financials, metrics and the customer list there. Add one ask.

01

Request code access

Acquire.com's own guide tells you to read the repository. Ask for read-only access: a GitHub invite the seller can revoke after the scan, or a zip in the data room. Serious sellers say yes. A refusal is a finding in itself.

02

We scan, without running it

Deterministic checks, no guesswork. Every finding is pinned to a real file and line with the exact snippet shown, translated into what it means for the deal.

03

Close, renegotiate, or walk

Clean report: close with confidence. Findings: make fixes and credential rotation conditions of closing, adjust the price, or walk before the funds release, not after.

What does a finding look like in the data room?

No vague grades. Every finding is pinned to a line of real code: specific enough that “that's not an issue” doesn't survive contact with it, clear enough that you don't need a CTO to understand it.

Critical
Dependency that doesn't exist in any registry
package.json:28 · "react-auth-helper-pro"
Critical
Database password committed to git history
.env.backup:2 · recoverable by seller after transfer
Transfer risk
No database migrations: schema exists only in the live system
supabase/ · migrations directory absent
5 more findings in the full report
The free preview counts the criticals before you spend a cent. The full report shows you each one.Read a full sample reportUnlock the full report

What does a code audit cost against an Acquire.com deal?

SaaS on Acquire.com sold at a median 3.9× profit in both 2024 and 2025. One scan, one payment. Run it during diligence, use it at the negotiating table, done. The pricing page sets it against the $500 to $5,000 alternatives.

You're about to wire 3.9× a year's profit for a codebase you've never opened. Knowing what's in it costs $49 while the first 50 last, $99 after.

$0

Free preview

A count of the critical findings in the code. Enough to know whether there's a problem worth raising, before you pay for the detail.

Get the free preview
full report
$49
$99one-time

Every finding with file-and-line proof, the exact code, a plain-English explanation of what it means for the deal, and a PDF you can put in front of the seller.

Get full report ($49)

What this covers, and what it doesn't.

This is one layer of SaaS due diligence: the technical asset. It doesn't check churn, customer concentration, traffic quality, or the seller's claims about anything but the code. It's a static review, not a penetration test, and a clean result is not a certification. We report what we can prove: the file, the line, and the exact code. Ascertify is independent and not affiliated with Acquire.com or any marketplace.

What do Acquire.com buyers ask before running a scan?

Does Acquire.com vet the code of a listing?
No. Acquire.com's vetting is about the business: it says it approves about 13% of submissions and asks for real revenue, real customers and clean financials, and sellers can optionally connect Stripe, ChartMogul or Baremetrics so buyers see customers, ARR and growth in real time. Its own guides tell buyers to do technical due diligence themselves or hire an agency. Nobody at Acquire.com opens the repository.
What does a vetted listing on Acquire.com actually mean?
That the startup passed Acquire.com's curation: a real business with real revenue, real customers and clean financials, and a seller whose identity checks out. Connected metrics are optional, so a listing can skip them. Vetting says nothing about what's in the code, whether the dependencies exist, or whether anyone but the founder can run it.
When in the acquisition process should I run the scan?
During due diligence, after your offer is accepted and before funds release from escrow. Acquire.com's closing flow runs NDA, data room, LOI, due diligence, purchase agreement, escrow; the scan belongs in the due-diligence step. That's when you have both code access and leverage: findings become conditions of closing, price adjustments, or reasons to walk while walking is still free.
How do I get the code before I own the business?
Ask, the same way you ask for the P&L and the Stripe screenshots. Acquire.com's own guide tells you to read the repository history, so the request is expected. The seller grants read-only access to the GitHub repository, which they can revoke right after the scan, or shares a zip through the data room. A seller who refuses any code access before you wire five or six figures has handed you a finding for free.

the message to send the seller

Before funds release, I'd like to run an independent static code audit on the repository. It reads the code without running it, installs nothing, and the code is deleted after the scan. Could you add me as a read-only collaborator on the repo for 48 hours? Revoke it as soon as the scan completes. If a zip in the data room is easier, that works too.

A serious seller says yes, because a clean report helps them close. A seller who refuses read-only access before you wire has handed you a finding for free. Once you have access, use GitHub's Download ZIP on the repository and upload that zip. The GitHub connect option needs admin rights on the repo, which a collaborator invite does not give you.

A lot of listings are AI-built now. Does that matter?
AI-built isn't a defect; some of the best small SaaS right now was built with Cursor or Claude. But AI-built code fails in recognizable ways: dependencies invented out of thin air, secrets pasted where they ship to the browser, a database schema that's all template and no product. The scan doesn't care who or what wrote the code. It tells you whether what was written is safe, real, and transferable.
Does this replace hiring a technical due diligence agency?
Not for everything. Acquire.com's guide says to hire an agency for technical due diligence and that they're expensive but worth it; for a six-figure deal on a complex stack, that advice stands. Ascertify covers one layer, the code, as a static scan that never executes anything, for $49 while the first 50 scans last, $99 after. Use it as the first pass that tells you whether there's anything worth paying an agency to look at.
What stacks are supported?
JavaScript and TypeScript apps: Next.js, React, Node, with deep checks for Supabase, Firebase, and Prisma. That covers most modern bootstrapped SaaS and nearly everything built with AI tools. The free preview tells you whether a codebase is a fit before you pay.

Sources, as published by Acquire.com on 5 Sep 2026: Acquire.com, How Acquire.com Works: Sell Your Startup or Buy One; Acquire.com, Can You Do Technical Due Diligence Without Being a Coder?; Acquire.com, How to Do Technical Due Diligence on a SaaS Startup; Acquire.com, Biannual Acquisition Multiples Report (Jan 2026); Acquire.com Help, connecting customer metrics via ChartMogul.

buying somewhere else?

The same check, for every marketplace.

Every marketplace verifies the business and none of them read the code. The scan is the same wherever the listing lives; the SaaS due diligence overview explains what it covers.

Know what you'd own before the escrow releases.

The free preview takes minutes and tells you whether there's anything in the code worth negotiating over. Start there.

Scan the code, free to start

Read-only access. The code is sandboxed, never executed, and deleted after the scan.