How do I know if source code is nulled, resold or stolen?
Nulled or resold code is code someone is selling that they did not write and have no right to distribute. The reliable tells are internal: another product’s name in licence headers, database table prefixes or asset paths; a demo hosted on a free subdomain rather than the seller’s own domain; a price far below the category; a refusal to screen-share the repository; and removed or patched licence-check code. Any one of those is enough to walk away.
Written by ZoopCoder, who build and sell SaaS source code. That makes us an interested party in this answer, so we have kept it to things you can verify yourself.
The numbers
Zero
Licence you receive
You cannot legally operate or resell it.
Zero
Updates and security fixes
Including the ones for vulnerabilities already public.
9 checks
To confirm before paying
All doable in under half an hour.
The nine checks
Run these before money moves. They are ordered so the cheapest ones come first — most fakes fail in the first three.
- 1. Is the demo on the seller’s own domain? A vendor selling their own product hosts it at their own name with a valid certificate. A free subdomain or a bare IP address for a $300 product is a strong negative signal.
- 2. Does the price make sense? A complete multi-tenant platform at $19 is not a bargain, it is a redistribution. Nobody builds and supports a marketplace for that.
- 3. Search the product name plus “nulled”. If the exact product is circulating on warez sites, you are likely being offered that copy at a markup.
- 4. Read the licence headers in the files. Ask for two or three real source files before purchase. Another company’s copyright notice at the top — or a suspiciously stripped header where one clearly used to be — ends the conversation.
- 5. Check database table prefixes and migration names. These are the hardest thing to rebrand and they frequently carry the original product’s initials.
- 6. Check asset paths, CSS class names and email templates. Rebranding usually stops at the logo. Original names survive in image directories, print stylesheets and the footer of transactional emails.
- 7. Look for a defeated activation check. Commented-out licence validation, a function that always returns true, or a hosts-file entry blocking the vendor’s domain are all signatures of nulling.
- 8. Ask for a screen-share of the repository. Real vendors will walk you through their own code and their commit history. This single request resolves most cases.
- 9. Ask a hard technical question about the architecture. How tenant isolation is enforced, or how the queue retries a failed payment. Someone who did not write the code cannot answer without looking it up, and it shows.
What you are actually risking
People underestimate this because the software appears to work. That is the point — it works, and the costs arrive later.
| Risk | What it looks like in practice |
|---|---|
| No licence to operate | The real rights-holder can demand you take the service down. Your customers are on it. |
| No security updates | When a vulnerability in the original is published, the fix reaches legitimate buyers and not you. Your deployment is now a documented target. |
| Injected backdoors | Nulled builds are a well-known distribution channel for added admin accounts and remote-execution shells. You cannot find what you cannot audit if the source is also obfuscated. |
| No support and no upgrade path | Every bug is yours forever, on a codebase you did not write and have no documentation for. |
| Payment-processor exposure | Gateways and app stores both act on infringement complaints. Losing the ability to take money ends the business faster than the lawsuit would. |
What a legitimate seller looks like
The positive signals, for symmetry. None of them individually proves originality, but a seller with all five is very unlikely to be reselling.
- A live demo on their own domain, with a valid certificate, that you can register on yourself.
- A named company or a named person with a traceable history, not just a checkout page.
- A changelog or release history going back more than a year.
- Willingness to answer architecture questions in writing, before payment.
- Licence terms stated on the invoice, including whether you may resell or operate the software as a service.
Where to go next
These pages carry the detail this answer summarises.
Frequently asked questions
Is nulled software illegal to use?
Distributing and using it without a licence infringes the author's copyright. Beyond the legal position, the practical exposure is worse: no updates, a documented vulnerability surface, and a rights-holder who can have your service taken offline while your customers are using it.
How can I check a seller is the original author?
Ask them to screen-share the repository and walk you through a feature, and ask one specific architecture question. Original authors do both without hesitation. Also check that the demo runs on their own domain and that the product name does not appear on nulled-download sites.
What if the code has another company name in it?
Ask, and treat the answer sceptically. There are innocent explanations — a rebranded product they legitimately acquired, or a framework whose name persists — but the burden is on the seller to evidence it. Absent evidence, do not buy.
Are cheap scripts always nulled?
No. Small, genuinely simple scripts sell legitimately at $30-$60. The signal is price relative to scope: a complete multi-tenant platform with billing, apps and admin panels does not get built and supported for the price of a takeaway.
Get a quote or a guided demo
Tell us your use case and we'll send pricing, a live demo walkthrough and licensing options for SaaS source code. Usually a reply within one business day (IST).