Due diligence checklist before buying a SaaS app
MRR screenshots and a traffic graph tell you the business worked yesterday. They tell you nothing about whether it's leaking data or money today, or what you'll inherit the day after the deal closes.
Why financials and traffic don't show security debt
A revenue screenshot, a Stripe MRR chart, an analytics dashboard — every one of them is a snapshot of outcomes, not of how the app was built. An app can show healthy, growing MRR while a Supabase table has row level security switched on but written wrong, while a Stripe webhook accepts an unsigned request, while cancelled customers keep paid access because nobody checks. None of that shows up in a revenue number until someone finds it — usually after you own it.
The specific things that become post-acquisition problems
- Open RLS on a customer-data table. Discovered post-close, this is a disclosure and remediation problem, not just an engineering ticket — depending on what the table holds.
- No database backups configured. The first production incident after you own the app is the worst possible time to learn there was nothing to restore from.
- Test and live Stripe keys mixed across environments. Either real payments have been silently failing, or a staging script has been charging real cards — both are the kind of thing that should be known before the price is agreed, not after.
- An admin panel with no real auth check on the server. A route that looks locked down in the UI but isn’t checked server-side is a full account-and-data compromise waiting for someone to find the URL.
A short checklist you can ask the seller, first
These are reasonable questions to ask before you spend money on any formal check — a seller who can’t answer them isn’t necessarily hiding something, but the answers change how much diligence you need to do yourself:
- Is row level security enabled on every table that holds customer data, and can you show me the policies, not just the toggle?
- Are database backups (point-in-time recovery) turned on, and when was the last one actually tested?
- Is the Stripe integration running exclusively on live keys in production, with webhook signature verification in place?
- Does a cancelled or failed-payment customer actually lose access, or just stop being billed?
- Has this app ever had a security review, internal or external, and can I see it?
How a dated, signed report fits into a negotiation
A report isn’t a substitute for your own legal review of the deal, and it’s not a warranty — it’s a factual record of what specific, provable issues existed on the date of the scan, so you can factor real risk into price or terms instead of negotiating on a feeling. If a Due Diligence report comes back clean, that’s one less unknown. If it doesn’t, you have a specific, itemized list — with the request that proved each finding — to bring to the negotiation, rather than a vague sense that something might be wrong.
Get a dated report before the money moves.
Due Diligence is $399 per app — a signed report the seller grants access for, built for a one-time review before you buy.