Due Diligence Checklist

Freelancers, co-founders, employees — anyone who wrote code. Without this, they retain rights.

GPL code in a commercial product can void your ability to close-source it. Run a license audit.

Most employment contracts give employers rights to IP built on company time or with company resources.

Ask directly. Check PACER (US) or equivalent for any filings involving the seller or the product name.

Request a WHOIS screenshot dated within the last 30 days. Domain in a third party's name is a red flag.

A live trademark in your category means rebrand risk post-acquisition.

Commit history, branch structure, test coverage. A healthy repo has a coherent commit history.

Scan for secrets before you inherit them. Use truffleHog or similar.

Run npm audit / pip check. A stack built on abandoned libraries has a compounding maintenance debt.

AWS accounts, serverless configs, DB connections. Undocumented infrastructure is a hidden migration cost.

Run a dependency vulnerability scan. High-severity CVEs in key packages are deal blockers.

A live demo removes doubt. Request a screenshare, not just screenshots.

Request a Google Analytics, Mixpanel, or PostHog export. Self-reported user counts are often inflated.

Can you talk to one? A seller who refuses to connect you with any customer is a yellow flag.

Even pre-revenue, early engagement data tells you if anyone actually uses this thing.

Ask for the LOI emails. Waitlist email addresses. Real intent signals leave a paper trail.

Even 2 weeks of knowledge transfer is worth negotiating. Specify it in the purchase agreement.

Locked to a personal account with no way to transfer = major post-acquisition headache.

Ask directly in writing. Include a rep/warranty clause in the purchase agreement.

A seller under financial pressure closes fast. One changing their mind halfway through doesn't.