Revenue charts, dashboard tours, “passive income, 2 hours a week.” All of it is presentation. The codebase is the asset, and it can't lie about what it is. Ascertify reads it before you commit, and tells you in plain English whether you're buying a product or a template with a Stripe key.
Read-only repo invite or a zip from the seller. We read the code. We never run it.
The database contains only the default login tables that ship with the starter template. None of the tables the product's features would need appear to exist. The data layer, the part that makes a SaaS a SaaS, may never have been built. What the demo shows and what the code contains are two different products.
Ascertify is an independent static code audit for buyers on Flippa and other marketplaces. It scans the codebase behind a listing, without ever executing it, and reports what it finds in plain English with the exact file and line as evidence. It answers the three questions a listing page can't: is the product real, what exposure do you inherit, and can anyone but the seller actually run it.
One scan, one payment, $49. The free preview shows the critical-finding count before you pay. Not a penetration test, and not affiliated with Flippa.
a template with a landing page can look exactly like a business
Dependencies invented by an AI, a schema that's all default scaffolding, the whole codebase committed in one dump the week before listing.
the seller's shortcuts become your liabilities at transfer
Live credentials in git history the seller can still use after the sale, admin keys shipped to every visitor's browser, database rules open to the internet.
"passive income" assumes someone can actually operate the thing
No setup instructions, no record of the database structure, no tests. If only the seller can run it, the passivity was theirs, not yours.
You'd check the traffic and the revenue claims. The code is one more ask, and the cheapest one.
The seller grants a read-only GitHub invite they can revoke after the scan, or shares a zip. Anyone selling a legitimate codebase can share it read-only for an afternoon. A refusal is a finding in itself.
Deterministic checks, no guesswork. Every finding is pinned to a real file and line with the exact snippet shown, translated into what it means for the deal.
Clean report: proceed knowing what you're buying. Findings: lower your bid, make fixes and credential rotation conditions of the sale, or walk before the money moves.
No vague grades. Every finding is pinned to a line of real code: specific enough that “that's not an issue” doesn't survive contact with it, clear enough that you don't need a CTO to understand it.
One scan, one payment. Run it during diligence, use it at the negotiating table, done.
The listing asks $25,000 for a codebase nobody's opened. Knowing what's in it costs $49.
Free preview
A count of the critical findings in the code. Enough to know whether there's a problem worth raising, before you pay for the detail.
Get the free previewEvery finding with file-and-line proof, the exact code, a plain-English explanation of what it means for the deal, and a PDF you can put in front of the seller.
Get full report ($49)This is one layer of due diligence: the technical asset. It doesn't verify traffic, revenue, churn, or the seller's claims about anything but the code. It's a static review, not a penetration test, and a clean result is not a certification. Findings describe observable facts in the code, not conclusions about any seller's conduct or intent. We report what we can prove: the file, the line, and the exact code. Ascertify is independent and not affiliated with Flippa or any marketplace.
The code answers this in ways screenshots can't. A real product has a database schema built for its features, dependencies that exist, and a commit history showing the thing being made. A flipped template has default scaffolding where the data model should be, packages an AI invented, and most of the code arriving in one dump right before listing. We check all of it statically and pin each finding to the exact file and line.
Screenshots show that money moved; they don't show what you're buying. Revenue can come from a launch spike or the seller's own network, and a product can work today while leaking customer data tomorrow. The codebase is the asset that transfers. If it's leaking credentials or missing its data layer, the revenue history won't save you after the handover.
Ask the seller for read-only access during diligence: a GitHub invite they can revoke after the scan, or a zip. On lower-priced listings sellers sometimes resist; that resistance is information. Anyone selling a legitimate codebase can share it read-only for an afternoon. A seller who won't let anyone look at what they're selling has answered your question already.
AI-built isn't a defect, and some fast-built products are genuinely good. But AI-built code fails in recognizable ways: invented dependencies, secrets shipped to the browser, a schema that's all template and no product. The scan doesn't care who wrote the code. It tells you whether what was written is safe, real, and transferable, which is the only question that matters at handover.
No. Traffic quality, revenue verification, churn, and seller history still need checking. We cover exactly one layer: the code you're buying. It's a static scan, not a penetration test, and it never executes the code. It's the layer most buyers skip because they can't read code, and the one where the worst surprises hide.
JavaScript and TypeScriptapps: Next.js, React, Node, with deep checks for Supabase, Firebase, and Prisma. That covers most modern micro-SaaS and nearly everything built with AI tools. WordPress and content sites aren't supported, and the free preview tells you whether a codebase is a fit before you pay.
The free preview takes minutes and tells you whether there's anything in the code worth negotiating over. Start there.
Scan the code, free to startRead-only access. The code is sandboxed, never executed, and deleted after the scan.