How do I check the quality of source code before I buy it?
Get read access to the real repository before you pay, then spend an hour on six checks: how old the dependencies are, whether secrets are committed, how data is scoped per customer, whether automated tests exist, whether the database is built by migrations, and whether the live demo actually runs this code. A seller who will not show you a repository has told you what you need to know.
Written by ZoopCoder, who build and sell SaaS source code. That makes us an interested party in this answer, so we have kept it to things you can verify yourself.
The numbers
6 checks
About one hour in total
None of them needs you to read every line.
Repo access
The prerequisite
A zip of compiled or encoded files cannot be audited.
1 red flag
Refusing a screen-share
Fixable code problems are normal; hiding the code is not.
The six checks, in the order that exposes problems fastest
Do these in order — the first two take ten minutes and eliminate most of the bad purchases. You can run them yourself or hand the list to any freelance developer for an hour of paid review.
| # | Check | What good looks like | What to walk away from |
|---|---|---|---|
| 1 | Dependency age | The lock file (composer.lock, package-lock.json) lists framework versions that are still receiving security fixes | A framework several major versions behind, or no lock file at all |
| 2 | Committed secrets | Config is read from environment variables; an example file such as .env.example holds placeholders only | Real-looking API keys, database passwords or private keys inside tracked files |
| 3 | Tenant scoping | Customer data is filtered in one central place (a base model, a global scope, a row-level policy) | The same WHERE tenant_id = ... hand-typed in each query, so one forgotten line leaks data |
| 4 | Tests | An automated test folder that runs and passes, even if coverage is thin | No tests at all on a product that handles payments or personal data |
| 5 | Database build | Versioned migrations that create the schema from empty | Only a single exported SQL dump, which makes every future upgrade a manual diff |
| 6 | Demo matches code | A feature you click in the demo can be traced to a route and a controller in the repository | Demo features with no matching code, or a demo running on a different stack |
Checks a non-developer can still do
- Ask for a screen-share of the repository. Watching someone open the folder tree, the lock file and the test folder takes twenty minutes and needs no technical skill. How the seller reacts to the request is itself the answer.
- Search the repository for the words
TODOandFIXME. A handful is normal; hundreds in payment or authentication code means unfinished work was shipped as finished. - Check the dates of the last commits. Steady small commits over a year are a healthier sign than one giant commit and nothing since.
- Pay a developer for one hour. Give them this table and the repository. It is the cheapest insurance on a purchase that otherwise commits you to months of building on top of the code.
None of these checks proves the product is good. They prove it is inspectable, which is the precondition for everything in spotting nulled or resold code and for migrating off it later.
Where to go next
These pages carry the detail this answer summarises.
Frequently asked questions
Is it reasonable to ask a seller for repository access before paying?
Yes, and an established seller will usually offer a screen-share or a read-only view under a short confidentiality note. Refusing every form of inspection while asking for full payment is the pattern to treat as a warning.
What if the code is encoded or obfuscated?
Treat it as a different product: you cannot audit it, extend it, or fix a security issue yourself, and your ability to migrate away later is gone. Encoded files are acceptable only when you have decided deliberately that you are buying a black box.
Do I need to read the code to do this?
No. Checks 1, 2, 4 and 5 are about which files and folders exist, not about reading logic. Check 3 is the one worth handing to a developer.
How long should the whole review take?
About an hour for a focused first pass. If a seller's code needs more than that just to find where the data is filtered, that is information about how maintainable it will be.
Get a quote or a guided demo
Tell us your use case and we'll send pricing, a live demo walkthrough and licensing options for SaaS source code. Usually a reply within one business day (IST).