THE ACQUISITION AUDIT: WHAT WE FIND BUYING RANDOM AI-BUILT SAAS

Eighteen acquisitions over four months. Three marketplaces. Every single app had at least one critical or high finding within an hour of close. This is the first published buyer-side dataset on AI-built SaaS acquisition security we are aware of.

If you are buying a vibe-coded app, the table below is your checklist. If you are listing one, it is the diligence question your buyer is going to run.

Headline numbers

What was wrong on day zero

Findings present at the moment of close, classified by category.

The standout — and the one most likely to be missed — is “seller still has credentials” (7 of 18). Marketplaces require the seller to transfer admin access to the buyer, but they do not require — and do not verify — that the seller has rotated their own credentials, removed their personal email from the DB user list, or revoked OAuth grants on connected services. In 7 of 18 cases, the seller could still log in as admin a week after handover.

By marketplace

The differences are partly platform-mix — Acquire.com listings skew larger, with more polished apps; Flippa listings skew smaller and earlier-stage. The seller-credentials-retained issue is more common on private deals because the handover is less mediated.

What sellers disclosed vs what we found

Of the 18 listings:

• 3 mentioned security in any form
• 0 included a recent third-party security audit
• 2 claimed compliance certifications (one GDPR, one SOC2-ready) — neither stood up to a five-minute check
• 0 disclosed any of the findings the scan eventually surfaced

This is not a claim that sellers are dishonest. It is a claim that sellers do not know. None of these apps had been previously scanned with anything close to this depth, and most builders cannot meaningfully describe the security posture of an app the AI built for them. The disclosure gap is structural.

The pre-close diligence we recommend

Based on findings present at close — what would have caught the criticals before wire transfer.

The cumulative cost of pre-close diligence that would have caught every critical in this study: under 30 minutes of buyer time and $19. The cost of the criticals themselves, if exploited post-close, is unbounded.

CWE / OWASP mapping for buyer triage

For triage at handover, the categories below are the ones to gate the holdback clause on. Every finding the buyer-side scan surfaces should carry its CWE and OWASP tag so the LOI language can refer back without ambiguity.

The “seller-still-has-credentials” row is the under-disclosed one. CWE-732 (Incorrect Permission Assignment for Critical Resource) is rarely flagged by automated scanners because it is not a code-level finding — it is a handover finding. The diligence step is procedural: confirm the seller has rotated their own creds, removed their email from admin roles, and revoked OAuth grants. Verify by attempting the login.

What buyers should add to their letter of intent

Based on what we encountered, the pre-close conditions that would have prevented every “seller still has credentials” finding:

• Seller rotates Stripe, Supabase, Firebase, and any AI provider keys at close
• Seller removes their personal email from all admin/owner roles at close
• Seller revokes OAuth grants on Google Workspace, GitHub, Slack at close
• Buyer runs an automated security scan within 24 hours of handover; criticals trigger the holdback clause

We are happy to share template LOI language with buyers; ask for it via the contact form.

Methodology

Sample. Eighteen AI-built SaaS apps purchased between Jan 2026 and Apr 2026 across Acquire.com, Flippa, and MicroAcquire. Selection was opportunistic — we filtered for listings identifying as built on Lovable, Bolt, Cursor, Replit, or V0 and within a $1k-$100k price range. We do not claim the sample is representative of all marketplace listings.

Scan timing. Each app was scanned within 60 minutes of admin-access transfer. The “at close” snapshot is the first scan; subsequent post-fix scans are not in this dataset.

Disclosure. Sellers were informed before close that anonymized findings would be published. No seller is named, no listing URL is published, no domain is revealed. Aggregate counts only.

Cost basis. “Total spent” is the actual purchase price across all 18 listings, range $1,200 to $84,000. We are happy to discuss methodology under NDA with any party considering a similar study.

Limits. Eighteen apps is small. We deliberately stayed small because the per-app cost is not negligible and the disclosure burden is real. The aggregate findings are directionally meaningful but the precise counts have wide confidence intervals.

Calibration via gapbench. The buyer-side diligence flow described in this study can be practiced and reproduced against gapbench.vibe-eval.com scenarios that mirror each finding shape — without needing real acquisition spend. The clean control (ref0) is what a properly-audited target should look like under the same scanner.

Reproduce on the public benchmark

The acquired apps are not public for seller-privacy reasons. The diligence flow itself is reproducible against gapbench scenarios that mirror the finding shapes:

A buyer who has run the diligence flow against the gapbench scenarios first will recognize each finding shape on a real listing in seconds. The cost of the practice run is zero; the cost of skipping it is unbounded.

Citations

VibeEval. The Acquisition Audit: What We Find Buying Random Apps from Acquire.com and Flippa. May 2026. https://vibe-eval.com/data-studies/acquisition-audit-acquire-flippa/

Related

• Pattern walkthrough: The Supabase service-role key in your frontend bundle — the modal critical at handover
• Pattern walkthrough: BOLA in AI-generated CRUD
• Pattern walkthrough: Mass assignment
• Pattern walkthrough: Magic links, OTP, password resets — for the seller-credentials-retained class
• Data study: 2026 AI App Security Benchmark
• Data study: Where Vibe Coders Leak Their Keys
• Data study: Honeypot Supabase — what happens after the leak
• Guide: Solo Founder Pre-Launch Security Checklist
• Tool: Free Security Self-Audit
• Comparison: Best Security Scanner for AI-Generated Apps