flippa due diligence · the code layer, before you bid

Screenshots can be staged. Code can't.

Flippa verifies revenue and traffic on listings priced above $50,000. Below that, it verifies nothing, and at no price does anyone at Flippa open the code. The codebase is the asset that actually transfers, and it can't lie about what it is. Ascertify reads it before you bid and tells you in plain English whether you're buying a product or a template with a Stripe key.

The listing: polished
Screenshots, revenue claims, a good story. That's marketing.
The code: unexamined
The asset itself. That's what you're actually bidding on.

Read-only repo invite or a zip from the seller. We read the code. We never run it.

What does Flippa verify, and what doesn't it?

Flippa's vetting team reviews the stated financial performance of every listing priced above USD $50,000. Below that, verification is the buyer's job. The code is nobody's job at any price.

Flippa verifies (listings above $50,000)
  • Stated revenue and primary expenses, against bank and source data
  • Traffic, through the Google Analytics integration
  • Monthly recurring revenue for SaaS listings
  • Seller identity and platform history
Nobody at Flippa verifies, at any price
  • Whether the dependencies in package.json exist
  • Whether live credentials sit in the codebase
  • Whether database rules are open to the internet
  • Whether the schema is a product or a template
  • Anything at all on listings under $50,000

Ascertify is an independent static code audit for buyers on Flippa. It scans the codebase behind a listing, without ever executing it, and reports what it finds in plain English with the exact file and line as evidence. One scan, one payment: $49 for the first 50 scans, then $99. The free preview shows the critical-finding count before you pay. Not a penetration test, and not affiliated with Flippa.

What can the code tell you that the listing can't?

Is the product real?

a template with a landing page can look exactly like a business

Dependencies invented by an AI, a schema that's all default scaffolding, the whole codebase committed in one dump the week before listing.

hallucinated dependencyschema has no real tables

What do you inherit?

the seller's shortcuts become your liabilities at transfer

Live credentials in git history the seller can still use after the sale, admin keys shipped to every visitor's browser, database rules open to the internet.

committed live credentialrow-level security disabled

Can you run it without them?

"passive income" assumes someone can actually operate the thing

No setup instructions, no record of the database structure, no tests. If only the seller can run it, the passivity was theirs, not yours.

no setup instructionsno database migrations

What does Flippa's own buying guide say to check in the code?

Flippa's guide to buying a SaaS business has a section called Product, Code, and Infrastructure. It tells you to check dependency age, test coverage, secrets handling, access controls, OSS compliance and IP assignment from every contractor, and to request a supervised code walkthrough or read-only repo access. It doesn't say who does that for a buyer who can't read code.

flippa's guide says to checkwhat the scan does
Dependency age; test coverage, CI or CDCovered in part: dependencies that don't exist in any registry, and whether the project has tests at all.
Secrets handling, access controlsCovered: live credentials in the codebase, admin keys shipped to the browser, Supabase row-level security and Firebase rules left open.
Supervised code walkthrough or read-only repo accessThis is the input. The scan takes that read-only access, or a zip, and never executes anything.
OSS compliance; IP assignment from all contractorsNot covered. That's paperwork, not code. Ask the seller for signed assignments.
Uptime history, monitoring, backups and restore testsNot covered. Those are runtime questions, and the scan never runs the app.

For everything else, Flippa points buyers to its Partner Directory. The due diligence listing there names four firms. Three describe financial or M&A diligence in their own words; one mentions software acquisitions. For the code layer on its own, Ascertify is $49 while the first 50 scans last, $99 after, and takes minutes, which is the right size for a listing where the whole deal is five figures. The rest of Flippa's list, the paperwork and the runtime questions, is on our SaaS technical due diligence checklist, marked by what the scan covers and what stays yours to ask.

our own data, not a vendor study

In September 2026 we scanned 70 public Lovable apps with the same checks a paid report runs. 28 of them, 40%, had a critical or high problem in code their own team wrote, and 19 of the 33 with edge functions had an endpoint anyone could call. The raw numbers are published. Read the Lovable security report →

When in a Flippa purchase should you run a code audit?

Between watching the listing and placing the bid. You'd check the traffic and the revenue claims anyway. The code is one more ask, and the cheapest one.

01

Request code access

Flippa's own guide tells you to ask for read-only repo access. Do that: a GitHub invite the seller can revoke after the scan, or a zip. Anyone selling a legitimate codebase can share it read-only for an afternoon. A refusal is a finding in itself.

02

We scan, without running it

Deterministic checks, no guesswork. Every finding is pinned to a real file and line with the exact snippet shown, translated into what it means for the deal.

03

Bid, negotiate, or walk

Clean report: proceed knowing what you're buying. Findings: lower your bid, make fixes and credential rotation conditions of the sale, or walk before the money moves.

What does a finding look like to the seller?

No vague grades. Every finding is pinned to a line of real code: specific enough that “that's not an issue” doesn't survive contact with it, clear enough that you don't need a CTO to understand it.

What got built
Database has only template tables, no product data model
prisma/schema.prisma · 0 custom models
Critical
Dependency that doesn't exist in any registry
package.json:28 · "react-auth-helper-pro"
Critical
Database password committed to git history
.env.backup:2 · recoverable by seller after transfer
5 more findings in the full report
The free preview counts the criticals before you spend a cent. The full report shows you each one.Read a full sample reportUnlock the full report

What does a code audit cost against a Flippa deal?

Deals between $50,000 and $100,000 on Flippa averaged $72,500 in 2025, and deals under $100,000 closed at 1.8× profit. One scan, one payment. Run it during diligence, use it at the negotiating table, done. The pricing page sets it against the $500 to $5,000 alternatives.

The average Flippa deal in the $50K band changes hands for $72,500 with the codebase unopened. Knowing what's in it costs $49 while the first 50 last, $99 after.

$0

Free preview

A count of the critical findings in the code. Enough to know whether there's a problem worth raising, before you pay for the detail.

Get the free preview
full report
$49
$99one-time

Every finding with file-and-line proof, the exact code, a plain-English explanation of what it means for the deal, and a PDF you can put in front of the seller.

Get full report ($49)

What this covers, and what it doesn't.

This is one layer of SaaS due diligence: the technical asset. It doesn't verify traffic, revenue, churn, or the seller's claims about anything but the code. It's a static review, not a penetration test, and a clean result is not a certification. Findings describe observable facts in the code, not conclusions about any seller's conduct or intent. We report what we can prove: the file, the line, and the exact code. Ascertify is independent and not affiliated with Flippa or any marketplace.

What do Flippa buyers ask before running a scan?

Does Flippa verify the code of a listing?
No. Flippa's verification covers stated revenue and primary expenses against bank and source data, traffic through its Google Analytics integration, and seller identity, and only for listings priced above USD $50,000. Its own SaaS buying guide tells buyers to check dependency age, test coverage, secrets handling and IP assignment themselves. Nobody at Flippa opens the repository at any price.
Is a Flippa listing under $50,000 verified at all?
Not by Flippa's vetting team. Flippa states that it reviews the stated financial performance of every asset priced above USD $50,000. Below that, revenue, traffic and the codebase are all the buyer's job to check. Most micro-SaaS and AI-built listings sit in that band.
How do I know if a Flippa SaaS listing is a real product?
The code answers this in ways screenshots and dashboards can't. A real product has a database schema built for its features, dependencies that exist, and a commit history showing the thing being made. A flipped template has default scaffolding where the data model should be, packages an AI invented, and most of the code arriving in one dump right before listing. Ascertify checks all of it statically and pins each finding to the exact file and line.
How do I get the code before bidding or closing?
Flippa's buying guide tells you to request a supervised code walkthrough or read-only repo access. Ask for the latter: a GitHub invite the seller can revoke after the scan, or a zip. On lower-priced listings sellers sometimes resist; that resistance is information. Anyone selling a legitimate codebase can share it read-only for an afternoon.

the message to send the seller

Before funds release, I'd like to run an independent static code audit on the repository. It reads the code without running it, installs nothing, and the code is deleted after the scan. Could you add me as a read-only collaborator on the repo for 48 hours? Revoke it as soon as the scan completes. If a zip in the data room is easier, that works too.

A serious seller says yes, because a clean report helps them close. A seller who refuses read-only access before you wire has handed you a finding for free. Once you have access, use GitHub's Download ZIP on the repository and upload that zip. The GitHub connect option needs admin rights on the repo, which a collaborator invite does not give you.

A lot of Flippa listings are AI-built now. Does that matter?
AI-built isn't a defect, and some fast-built products are genuinely good. But AI-built code fails in recognizable ways: invented dependencies, secrets shipped to the browser, a schema that's all template and no product. The scan doesn't care who wrote the code. It tells you whether what was written is safe, real, and transferable.
Does this replace Flippa's due diligence partners?
No. The firms in Flippa's Partner Directory cover financial, traffic and operational diligence, and revenue verification still matters. Ascertify covers exactly one layer, the code, as a static scan that never executes anything. It's the layer most buyers skip because they can't read code, and the one where the worst surprises hide at handover.
What stacks are supported?
JavaScript and TypeScript apps: Next.js, React, Node, with deep checks for Supabase, Firebase, and Prisma. That covers most modern micro-SaaS and nearly everything built with AI tools. WordPress and content sites aren't supported, and the free preview tells you whether a codebase is a fit before you pay.

Sources, as published by Flippa on 5 Sep 2026: Flippa, Trust and Safety by Design; Flippa, How to Buy a SaaS Business: The Complete Guide; Flippa, Online Business M&A Insights: 2025 Recap & 2026 Outlook; Flippa Partner Directory, due diligence.

buying somewhere else?

The same check, for every marketplace.

Every marketplace verifies the business and none of them read the code. The scan is the same wherever the listing lives; the SaaS due diligence overview explains what it covers.

Find out what's behind the listing before your money is.

The free preview takes minutes and tells you whether there's anything in the code worth negotiating over. Start there.

Scan the code, free to start

Read-only access. The code is sandboxed, never executed, and deleted after the scan.