Acquisition audit

Know what is in the code before you buy the business

You found a micro-SaaS or a small app for sale and the seller gives you read access to the repository. We read it and send you a PDF report, 5 days after payment and access for the express audit, with the risks ranked by severity and the questions to ask before you sign.

See prices

Offers and prices

Pre-acquisition express audit

Who it is for Buyers of micro-SaaS products and small apps who want a quick opinion before making an offer.

What you receive

A verdict on the overall state of the repository: readability and technical debt
The main risks, ranked by severity
Dependencies that are outdated, or known to be vulnerable at the declared versions
Questions to ask the seller before signing

Price: $750
Turnaround: 5 days after payment and access
Billing: One-time payment, before delivery
Deliverable: PDF report with a summary a non-engineer can read and the detailed findings
To get started: The URL of your Git repository. If it's private, we send you a read-only deploy key to add to it.

Order : Pre-acquisition express audit

Or write to contact@mog.gg

In-depth express audit (code, infrastructure, basic security)

Who it is for Buyers and investors who also want to know how the application is deployed and run.

What you receive

Everything in the express audit
A read of the infrastructure described in the repository: containers and deployment configuration
Basic security checks: authentication, input validation and secrets left in the code
A prioritized plan to bring the code back to a healthy state

Price: $1,390
Turnaround: 7 days after payment and access
Billing: One-time payment, before delivery
Deliverable: PDF report with a summary and a prioritized repair plan
To get started: The URL of your Git repository. If it's private, we send you a read-only deploy key to add to it.

Order : In-depth express audit (code, infrastructure, basic security)

Or write to contact@mog.gg

What the audit does not cover

The audit covers the source code you give us to read. We have no access to production, we run no penetration test and we do not check the application's data.

The analysis does not claim to be exhaustive: a report can miss a defect. It describes the code as it was when we read it, and it is neither a certification nor legal or financial advice.

How to order

You write
The Order button opens an email to contact@mog.gg with the offer as subject. The message already lists the fields to fill in for the invoice and for the start of the work.
We invoice
You receive an invoice that repeats the price and the turnaround of the offer.
You pay
Payment is due when you receive the invoice.
Work starts here
We deliver
The deliverable reaches you by email, as a PDF, at the address that placed the order.

Payment comes before delivery. We send the invoice as soon as your order arrives, and work starts when it is paid.

Frequently asked questions

Why a read-only deploy key?

The key gives read access to one repository. It cannot write to that repository and cannot read any other. You can remove it as soon as the report is delivered.

Is my code kept?

The code is deleted from our systems within 30 days of delivery. The terms of sale, which are in French, set out this confidentiality commitment.

Who does the audit?

WELLPLAYED SAS, with its own analysis tooling, in an environment isolated from the rest of our systems and without access to our secrets. The report goes through automatic checks before it is sent. The terms of sale describe how your code is processed.

Do I need to own the repository?

You need the right to give us read access. In an acquisition the seller usually grants it. The report goes to the email address that placed the order, so the buyer should be the one who orders.

Do the terms apply to me if I am outside France?

Yes. Our terms of sale are written in French and apply to every order. French law governs them.

What about after the fixes?

You can order a follow-up audit with the same scope, at 50% of the price paid for the first one. It runs the analysis again on the fixed code.

When does the work start?

When the invoice is paid. The turnaround shown on each offer runs from that moment.

Where is the deliverable sent?

To the email address that placed the order. We never send a deliverable to another address.