SaaS Technical Due Diligence Checklist (2026): Verify the Code

You can check a SaaS's revenue in minutes now. TrustMRR, one of the bigger listing sites, says every revenue figure on it is verified through payment providers like Stripe and RevenueCat (TrustMRR, retrieved 6 Oct 2026). The code is a different story. Most small deals close without anyone reading it.

That used to be a smaller risk. It isn't anymore. 84% of developers now use or plan to use AI tools in their work (Stack Overflow Developer Survey 2025). When Veracode gave coding tasks to more than 100 AI models, 45% of them came back with a security flaw (Veracode, 2025).

This guide is the checklist we use when we look at a codebase before money moves. Twelve checks, what each one means in plain English, the free tools that cover each one, how the paid options compare, and what to do in your first 30 days as the new owner.

Key takeaways

• Marketplaces verify revenue, not code. The code check is on you as the buyer.
• Four checks can sink a deal on their own: ownership, leaked secrets, open databases and missing server-side auth.
• Free tools cover most of the checklist if you know how to run them. A manual audit firm costs $8,000 to $25,000 and takes 2 to 4 weeks (Kolonell, 2026, a vendor estimate).
• AI pull-request reviewers are built to check new changes, not to audit a whole codebase for a buyer.
• On day one after you buy, rotate every secret. The seller still has the old ones.

What is SaaS technical due diligence?

SaaS technical due diligence is the buyer's check of the code, infrastructure, security, data handling and ownership of a software business before the purchase closes. For a small SaaS it answers three questions: is anything in the code dangerous, can I run this without the seller, and does anything here change the price?

Big acquisitions hire a firm for this. Indie deals on Acquire, Flippa or TrustMRR mostly skip it, because the audit can cost more than the margin on a $40k purchase. That's the gap this checklist is for.

It matters more in 2026 because of how the code gets written. Escape.tech scanned more than 5,600 publicly deployed apps built with AI coding tools and found over 2,000 vulnerabilities, more than 400 exposed secrets and 175 cases of exposed personal data (Escape.tech). If you're buying a vibe-coded app, assume you'll find something.

Before you start: what to ask the seller for

Get these before you run a single check. A seller who won't give them is telling you something.

• Read-only access to every repository. A GitHub App or a collaborator invite with read access is enough. You don't need write access and you shouldn't take it.
• A list of every outside service the product uses: hosting, database, payments, email, AI providers, analytics.
• The deploy steps, even if they're rough notes.
• Any security incidents, outages or data issues in the last two years.
• Who has written code for the product, including contractors.

Time needed: an afternoon for a small codebase if you're comfortable in a terminal. Difficulty: intermediate.

The 12-point SaaS technical due diligence checklist

The first four can sink the deal. The middle four usually change the price. The last four change how hard the handover will be.

1. Ownership and access

Check who owns the repository, the domain, the cloud accounts and the payment account, and that every contributor's work is assigned to the business. Contractor code without a written IP assignment is a common reason deals stall. Write down every account that has to change hands.

2. Secrets in the code and its history

Look for live keys: payment keys, database admin keys, AI provider keys, private keys and .env files. Check the git history too, because a key deleted last month is still in an old commit. GitGuardian found 28,649,024 new secrets in public GitHub commits in 2025, up 34% in a year (GitGuardian, 2026).

Free tool: gitleaks scans the whole history with gitleaks git -v (gitleaks, MIT licence).

3. Database exposure

If the app uses Supabase or Firebase, check that every table has row-level security or locked-down rules. One misconfigured Supabase database at Moltbook exposed 1.5 million API tokens and 35,000 email addresses (Wiz Research). On Supabase you can list tables without row-level security in the SQL editor:

select tablename from pg_tables
where schemaname = 'public' and rowsecurity = false;

4. Auth on every route

Every API route and server function that touches user data should check who's asking. Hiding a button in the UI isn't access control. Pick the five routes that matter most (billing, admin, data export, account settings, anything with a user id in the URL) and read how each one checks the caller.

5. Vulnerable dependencies

Packages with known CVEs are the cheapest risk to find. Turn on Dependabot alerts if the repo is on GitHub. It scans the default branch against the GitHub Advisory Database (GitHub Docs). For a Node project you can also run npm audit --omit=dev.

6. Open-source licences

A GPL or AGPL package linked into the product can create obligations you didn't plan for. Run a licence report, for example npx license-checker --production --summary, and read anything that isn't MIT, Apache or BSD.

7. Tests and CI

No tests means every change after the sale is a gamble. Check whether tests exist, whether they run on every push, and whether they pass today. A red pipeline the seller has ignored for months is a price conversation.

8. Bus factor

Run git shortlog -sne --all to see who wrote the code. If one person wrote nearly all of it and that person is the seller, everything about how it works lives in their head. Price in a paid handover period.

9. Can you deploy it?

Ask for the deploy steps and try them from a clean machine before closing, or at least walk through them on a call. Missing environment variables and undocumented manual steps are where handovers usually get stuck.

10. Third-party services

List every outside service, who pays for it, and whether the account can be transferred. AI provider bills in particular can grow quietly. Check the last three months of usage.

11. AI-written code quality

AI tools make it easy to copy rather than refactor. GitClear's 2025 analysis found that in 2024 copy-pasted code overtook moved or refactored code for the first time, and duplicated blocks of five or more lines rose about eightfold (DevClass, 2025). Skim the largest files. If the same logic appears in several places, budget time to clean it up.

12. Incident history

Ask about breaches, outages and data issues, then compare the answer with what you see in logs, status pages and support tickets. An unfixed incident in customer-facing systems should change the price.

Bug finder and code audit tools compared

No single tool covers the whole checklist. Each one answers a different question, and the difference matters when you're the buyer rather than the developer.

Approach	Built for	Good at	Not built for	Cost (Oct 2026)
Manual audit firm	Buyers on larger deals	Everything, with judgement	Small budgets and fast timelines	$8k to $25k, 2 to 4 weeks (Kolonell)
AI PR reviewers (CodeRabbit, GitHub Copilot code review)	Developers shipping changes	Catching issues in each new pull request	Auditing an existing codebase for a buyer	CodeRabbit from $24 per developer a month, billed yearly (CodeRabbit)
SAST scanners (Semgrep CE, SonarQube)	Engineering teams	Risky code patterns across the repo	Ownership, deploy, accounts	Semgrep CE is open source (Semgrep). SonarQube is free for private projects up to 50k lines (Sonar)
Dependency scanners (Dependabot, Snyk)	Engineering teams	Known CVEs in packages	Your own code, secrets, databases	Dependabot alerts are free on GitHub. Snyk's free plan includes 100 code tests a month (Snyk)
Secret scanners (gitleaks)	Anyone	Keys in files and old commits	Everything else	Free, MIT licence
git11	Buyers and sellers of small SaaS	A graded report across secrets, databases, dependencies, ownership, tests and deploy, with every finding pinned to a file and line	Running the app, penetration testing, legal review	Free scan. $99 full report per repo

A note on AI code review tools, because they come up a lot. GitHub's own docs describe Copilot code review as reviewing the changes in a pull request and suggesting fixes (GitHub Docs). That's exactly what you want while building. It isn't the same job as reading a whole codebase you've never seen, deciding what it's worth, and handing a report to someone who doesn't code.

How much does a code audit cost for a small SaaS?

A traditional technical due diligence audit for a SaaS acquisition costs $8,000 to $25,000 and takes 2 to 4 weeks, according to one vendor's 2026 pricing guide (Kolonell). On a large deal that's money well spent. On a $40k app it can be a fifth of the price.

A sensible order for small deals: run the free checks yourself, get a report you can share with the seller, and hire a firm only when the deal size or the findings justify it.

How to run the checklist in one afternoon

1. Get read-only access to the repo and clone it.
2. Run gitleaks git -v for secrets, including old commits.
3. Run semgrep scan for risky code patterns with the community rules.
4. Turn on Dependabot alerts or run npm audit --omit=dev for vulnerable packages.
5. Run git shortlog -sne --all for the bus factor and git log -1 --format=%cd for the last real change.
6. If there's a Supabase project, run the row-level security query from check 3.
7. Read the five most important routes for server-side auth.
8. Write down every finding with its file and line, so the seller can't say they don't know what you mean.

Step 8 is the one people skip. A finding with a file path and a line number turns a vague worry into a price conversation.

Red flags that should change the price

• A live payment or database admin key in the code or its history.
• Database tables anyone on the internet can read.
• Routes that return user data without checking who's asking.
• One author, no tests and no written deploy steps.
• A strong copyleft licence inside the shipped product.

None of these has to kill a deal. Each one has a cost to fix, and that cost belongs in the price or in the seller's to-do list before closing.

What to do after buying a SaaS

The first 30 days decide whether the handover goes smoothly. This is the order we'd follow.

1. Day 0: rotate every secret. New keys for payments, the database, email and AI providers. The seller still has the old ones, and so does anything they ever pasted them into.
2. Days 1 to 3: move every account into your name. Domain, hosting, app stores, Stripe, analytics, error tracking.
3. Week 1: deploy it yourself from a clean machine using the written steps. Fix the steps as you go.
4. Week 2: turn on alerts. Dependency and secret alerts, error tracking and uptime checks.
5. Day 30: run the same checks again and compare. Anything new is now yours.

Where git11 fits, and who built it

I'm Om. My co-founder Shreyash and I (about us) built git11 after watching small SaaS deals close with nobody reading the code. Marketplaces verify the revenue. We wanted the same kind of proof for the code.

git11 is a read-only GitHub App. It reads a repository and grades it A to F across five areas: security, dependencies, ownership, maintainability and how easy it is to run. Every finding is pinned to a file and line and explained in plain English. Sellers can share a public report link and badge with buyers, with code snippets hidden by default. The scan is free and a full report is $99 per repo (see pricing).

It doesn't replace everything. git11 reads the code. It doesn't run the app, do penetration testing or check contracts, and old commits are only partly covered today. For a large deal, use it to make a manual audit faster, not instead of one. You can read how we handle your code on our security page, and the docs explain how a scan works step by step.

The short version

• Revenue is verified for you. The code isn't.
• Run the 12 checks, or at least the first four, before you sign.
• Write every finding down with its file and line, and bring it to the price conversation.
• Rotate every secret the day the deal closes.

If you want the checklist run for you, scan a repo free at git11.xyz. You'll see the grade and the finding counts before you pay anything.