Flippa verifies revenue and traffic on listings priced above $50,000. Below that, it verifies nothing, and at no price does anyone at Flippa open the code. The codebase is the asset that actually transfers, and it can't lie about what it is. Ascertify reads it before you bid and tells you in plain English whether you're buying a product or a template with a Stripe key.
Read-only repo invite or a zip from the seller. We read the code. We never run it.
The database contains only the default login tables that ship with the starter template. None of the tables the product's features would need appear to exist. The data layer, the part that makes a SaaS a SaaS, may never have been built. What the demo shows and what the code contains are two different products.
Flippa's vetting team reviews the stated financial performance of every listing priced above USD $50,000. Below that, verification is the buyer's job. The code is nobody's job at any price.
Ascertify is an independent static code audit for buyers on Flippa. It scans the codebase behind a listing, without ever executing it, and reports what it finds in plain English with the exact file and line as evidence. One scan, one payment: $49 for the first 50 scans, then $99. The free preview shows the critical-finding count before you pay. Not a penetration test, and not affiliated with Flippa.
a template with a landing page can look exactly like a business
Dependencies invented by an AI, a schema that's all default scaffolding, the whole codebase committed in one dump the week before listing.
the seller's shortcuts become your liabilities at transfer
Live credentials in git history the seller can still use after the sale, admin keys shipped to every visitor's browser, database rules open to the internet.
"passive income" assumes someone can actually operate the thing
No setup instructions, no record of the database structure, no tests. If only the seller can run it, the passivity was theirs, not yours.
Flippa's guide to buying a SaaS business has a section called Product, Code, and Infrastructure. It tells you to check dependency age, test coverage, secrets handling, access controls, OSS compliance and IP assignment from every contractor, and to request a supervised code walkthrough or read-only repo access. It doesn't say who does that for a buyer who can't read code.
| flippa's guide says to check | what the scan does |
|---|---|
| Dependency age; test coverage, CI or CD | Covered in part: dependencies that don't exist in any registry, and whether the project has tests at all. |
| Secrets handling, access controls | Covered: live credentials in the codebase, admin keys shipped to the browser, Supabase row-level security and Firebase rules left open. |
| Supervised code walkthrough or read-only repo access | This is the input. The scan takes that read-only access, or a zip, and never executes anything. |
| OSS compliance; IP assignment from all contractors | Not covered. That's paperwork, not code. Ask the seller for signed assignments. |
| Uptime history, monitoring, backups and restore tests | Not covered. Those are runtime questions, and the scan never runs the app. |
For everything else, Flippa points buyers to its Partner Directory. The due diligence listing there names four firms. Three describe financial or M&A diligence in their own words; one mentions software acquisitions. For the code layer on its own, Ascertify is $49 while the first 50 scans last, $99 after, and takes minutes, which is the right size for a listing where the whole deal is five figures. The rest of Flippa's list, the paperwork and the runtime questions, is on our SaaS technical due diligence checklist, marked by what the scan covers and what stays yours to ask.
our own data, not a vendor study
In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →
Between watching the listing and placing the bid. You'd check the traffic and the revenue claims anyway. The code is one more ask, and the cheapest one.
Flippa's own guide tells you to ask for read-only repo access. Do that: a GitHub invite the seller can revoke after the scan, or a zip. Anyone selling a legitimate codebase can share it read-only for an afternoon. A refusal is a finding in itself.
Deterministic checks, no guesswork. Every finding is pinned to a real file and line with the exact snippet shown, translated into what it means for the deal.
Clean report: proceed knowing what you're buying. Findings: lower your bid, make fixes and credential rotation conditions of the sale, or walk before the money moves.
No vague grades. Every finding is pinned to a line of real code: specific enough that “that's not an issue” doesn't survive contact with it, clear enough that you don't need a CTO to understand it.
Deals between $50,000 and $100,000 on Flippa averaged $72,500 in 2025, and deals under $100,000 closed at 1.8× profit. One scan, one payment. Run it during diligence, use it at the negotiating table, done. The pricing page sets it against the $500 to $5,000 alternatives.
The average Flippa deal in the $50K band changes hands for $72,500 with the codebase unopened. Knowing what's in it costs $49 while the first 50 last, $99 after.
Free preview
A count of the critical findings in the code. Enough to know whether there's a problem worth raising, before you pay for the detail.
Get the free previewEvery finding with file-and-line proof, the exact code, a plain-English explanation of what it means for the deal, and a PDF you can put in front of the seller.
Get full report ($49)This is one layer of SaaS due diligence: the technical asset. It doesn't verify traffic, revenue, churn, or the seller's claims about anything but the code. It's a static review, not a penetration test, and a clean result is not a certification. Findings describe observable facts in the code, not conclusions about any seller's conduct or intent. We report what we can prove: the file, the line, and the exact code. Ascertify is independent and not affiliated with Flippa or any marketplace.
the message to send the seller
Before funds release, I'd like to run an independent static code audit on the repository. It reads the code without running it, installs nothing, and the code is deleted after the scan. Could you add me as a read-only collaborator on the repo for 48 hours? Revoke it as soon as the scan completes. If a zip in the data room is easier, that works too.
A serious seller says yes, because a clean report helps them close. A seller who refuses read-only access before you wire has handed you a finding for free. Once you have access, use GitHub's Download ZIP on the repository and upload that zip. The GitHub connect option needs admin rights on the repo, which a collaborator invite does not give you.
Sources, as published by Flippa on 5 Sep 2026: Flippa, Trust and Safety by Design; Flippa, How to Buy a SaaS Business: The Complete Guide; Flippa, Online Business M&A Insights: 2025 Recap & 2026 Outlook; Flippa Partner Directory, due diligence.
Every marketplace verifies the business and none of them read the code. The scan is the same wherever the listing lives; the SaaS due diligence overview explains what it covers.
The free preview takes minutes and tells you whether there's anything in the code worth negotiating over. Start there.
Scan the code, free to startRead-only access. The code is sandboxed, never executed, and deleted after the scan.