Pre-Acquisition Security & Penetration Testing: The Buyer's Vulnerability Checklist

Revenue screenshots do not transfer security posture. Sellers routinely present MRR dashboards while hiding IDOR vulnerabilities on billing APIs, misconfigured cloud storage with customer PII, expired SSL certificates on admin subdomains, and SOC 2 badges that cover a different legal entity than the one you are buying. A disciplined saas security audit workflow separates acquirers who compound cash flow from buyers who inherit a breach disguised as recurring revenue.

This masterclass is written for acquisition entrepreneurs evaluating SaaS, browser extensions, and API-first tools in the $10k–$500k range. You will learn how to run a quick-action vulnerability assessment web sprint, map findings to the OWASP Top 10, audit cloud config policies across AWS, GCP, Vercel, and Supabase, verify GDPR and SOC 2 alignment, structure penetration testing due diligence requests, and convert security scores into price reductions and escrow holdbacks before you wire funds.

Pair this with our technical due diligence checklist, micro-SaaS tech stack audit, and IP & copyright due diligence playbook for a complete buy-side operating stack.

Not legal or security advice. Penetration testing requires written authorization. Engage qualified security professionals and counsel before acting on findings or modifying production systems.

1. The Security Due Diligence Topology: What You Are Actually Inheriting

Security posture in a SaaS acquisition is not a single checkbox—it is a stack of overlapping controls that must each be verified independently. A clean codebase with an open S3 bucket still fails security diligence. A SOC 2 Type II report from 2023 with no change-management evidence since a major architecture refactor is marketing, not assurance.

1.1 The six-layer security ownership model

1.2 Security Risk Score (SRS): The composite diligence metric

Quantify security exposure with a weighted composite score. Use this to negotiate price reductions, escrow holdbacks, or walk-away decisions— the same way you apply TDS for technical debt.

Example: a $60k micro-SaaS with SRS = 2.9 (critical IDOR + open bucket + no DPA) should trigger a $7,200–$10,800 price reduction or equivalent escrow holdback tied to remediation milestones.

“Security debt compounds faster than technical debt. A SQL injection you inherit on Day 1 becomes a GDPR notification on Day 47 and a churn event on Day 60. Price it before close, not after the breach.”

2. Pre-Audit Access: The Security Data Room Checklist

Never sign an LOI without defined security access. Minimum artifacts for any software acquisition:

• Staging or sandbox environment — mirror of production with synthetic data for safe testing
• Cloud console read-only access — AWS IAM, GCP, Vercel team viewer, Supabase dashboard
• Most recent pentest report — full findings with remediation status, not executive summary only
• SOC 2 Type II report — if claimed; verify scope, period, and entity name match the asset
• Subprocessor list + DPAs — for GDPR-relevant assets with EU customers
• Incident response log — past 24 months of security events, breaches, and near-misses
• Secrets inventory — where API keys live (Vault, env vars, CI); rotation policy

If the seller refuses staging access citing “production risk,” offer a time-boxed pentest window with written Rules of Engagement (RoE) and liability caps under NDA. No access = no close.

2.1 Access request template (send before LOI)

3. The 4-Hour Quick-Action Security Audit Sprint

Before commissioning a $5k–$15k professional pentest, run this buyer-side sprint to filter obvious failures and build your SRS inputs. Non-technical buyers should hire a fractional security engineer for 4–6 hours ($600–$1,200).

3.1 Sprint timeline

3.2 Automated vulnerability assessment web script

Run against staging only, with written authorization. This baseline script combines subdomain discovery, header analysis, and ZAP passive scanning:

#!/usr/bin/env bash
# Pre-acquisition vulnerability assessment — STAGING ONLY
# Requires: subfinder, httpx, nuclei, OWASP ZAP (or Docker)
set -euo pipefail

TARGET="${1:?Usage: ./security-audit.sh staging.example.com}"
OUT_DIR="./security-audit-$(date +%Y%m%d)"
mkdir -p "$OUT_DIR"

echo "[1/5] Subdomain enumeration..."
subfinder -d "$TARGET" -silent | httpx -silent -status-code -title \
  > "$OUT_DIR/subdomains.txt"

echo "[2/5] Security headers check..."
while read -r url; do
  curl -sI "$url" | grep -iE 'strict-transport|content-security|x-frame|x-content'
done < "$OUT_DIR/subdomains.txt" > "$OUT_DIR/headers.txt" 2>/dev/null || true

echo "[3/5] Nuclei critical/high scan..."
nuclei -l "$OUT_DIR/subdomains.txt" -severity critical,high \
  -o "$OUT_DIR/nuclei-findings.txt"

echo "[4/5] OWASP ZAP baseline (Docker)..."
docker run --rm -v "$OUT_DIR:/zap/wrk" owasp/zap2docker-stable \
  zap-baseline.py -t "https://$TARGET" -r "$OUT_DIR/zap-report.html" \
  -J "$OUT_DIR/zap-report.json" || true

echo "[5/5] TLS certificate check..."
echo | openssl s_client -connect "$TARGET:443" -servername "$TARGET" 2>/dev/null \
  | openssl x509 -noout -dates -issuer > "$OUT_DIR/tls.txt"

echo "Audit complete. Review $OUT_DIR/"

3.3 Manual auth boundary tests (highest ROI)

Automated scanners miss authorization flaws—the #1 source of SaaS breaches. Test these manually on staging with two accounts (User A and User B):

1. IDOR on resource IDs: copy User B's invoice/API key/export URL; access as User A
2. Horizontal privilege escalation: change tenant_id or org_id in JWT/API requests
3. Vertical escalation: access /admin routes as standard user; test GraphQL introspection
4. Mass assignment: add “role”: “admin” to profile update JSON
5. Password reset flow: token reuse, no expiry, predictable tokens
6. API key scope: read-only key performing write/delete operations

4. OWASP Top 10: The SaaS Buyer's Mapping Framework

The OWASP Top 10 (2021, still the industry baseline in 2026) provides a structured lens for penetration testing due diligence. Map every finding to a category, assign severity, and attach remediation cost.

4.1 OWASP Top 10 → acquisition risk matrix

4.2 OWASP finding severity → SRS sub-score conversion

5. Cloud Config Policies: The Infrastructure Security Audit

Misconfigured cloud resources cause more SaaS breaches than novel exploits. Audit IAM, storage, network, and serverless policies before close—especially on AWS, GCP, Vercel, Railway, and Supabase stacks common in micro-acquisitions.

5.1 Cloud config policy checklist by platform

5.2 AWS Prowler one-liner for buyer-side audit

# Read-only IAM role required — seller grants SecurityAudit policy
pip install prowler
prowler aws --severity critical high \
  --output-formats csv json \
  --output-directory ./prowler-audit \
  --status FAIL

# Flag immediately:
# - s3_bucket_public_access
# - iam_user_mfa_enabled_console (root/admin without MFA)
# - ec2_securitygroup_allow_ingress_from_internet_to_any_port
# - rds_instance_public_access
# - cloudtrail_multi_region_enabled (must be true)

5.3 Supabase RLS verification query

Row Level Security bypass is the most common Supabase acquisition vulnerability. Run on a read-only database connection:

-- Tables WITHOUT row-level security enabled (FAIL if user data)
SELECT schemaname, tablename, rowsecurity
FROM pg_tables
WHERE schemaname = 'public'
  AND rowsecurity = false;

-- Policies that use USING (true) — effectively no isolation (FAIL)
SELECT schemaname, tablename, policyname, qual
FROM pg_policies
WHERE schemaname = 'public'
  AND qual = 'true';

5.4 CloudScore formula

6. GDPR & SOC 2 Alignment: Compliance Due Diligence

Security and compliance overlap but are not identical. A pentest-clean app can still fail GDPR if consent flows are broken or subprocessors lack DPAs. Enterprise buyers require SOC 2 alignment—verify scope, not just badge presence.

6.1 GDPR alignment checklist (EU customer exposure)

6.2 SOC 2 verification matrix

SOC 2 badges on marketing sites are frequently misleading. Verify these six points before crediting compliance value in your offer:

1. Entity match: report legal name = APA target entity
2. Report type: Type II (not Type I only); period covers last 12 months
3. Trust criteria: Security minimum; Availability/Confidentiality if claimed
4. Scope: production environment included; not “corporate IT only”
5. Exceptions: read management response to every qualified opinion
6. Subservice orgs: AWS, Stripe listed with complementary controls noted

6.3 ComplianceScore formula

7. Professional Penetration Testing Due Diligence

The 4-hour sprint filters obvious failures. For deals above $75k or assets with enterprise customers, commission a scoped pentest before close. Budget $3k–$12k depending on scope and firm tier.

7.1 Pentest scope tiers for acquisitions

7.2 Rules of Engagement (RoE) clauses for seller authorization

• In-scope targets only — staging URLs and IP ranges listed explicitly; production off-limits unless seller opts in
• Testing window — date/time bounds; no DDoS or destructive payloads
• Data handling — findings encrypted at rest; destroyed 90 days post-close
• Liability cap — buyer indemnifies seller for authorized testing damage
• Deliverables — full technical report + executive summary + retest option within 30 days

7.3 Pentest report red flags (reject or renegotiate)

8. Converting Security Findings into Deal-Price Renegotiation

Security findings are negotiation leverage only when translated to dollars and timelines. Use the Security Remediation Budget (SRB) formula to compute EV adjustment, then layer holdback structure on top.

8.1 Security Remediation Budget (SRB)

8.2 Price adjustment formula

8.3 Escrow holdback structure for security reps

Pair SRB math with reps and warranties from our legal framework guide. Require seller rep that no Critical/High findings in the pentest report were known and undisclosed.

9. Master Security Diligence Checklist (Print & Execute)

Use this consolidated checklist on every SaaS target. Score each item Pass / Fail / N/A; compute SRS before LOI revision.

9.1 Application layer

• OWASP ZAP or Nuclei scan completed on staging (Critical = Fail)
• Manual IDOR test on billing, exports, API keys (any fail = P0)
• Admin routes blocked for standard users
• Rate limiting on auth and API endpoints
• CSP, HSTS, X-Frame-Options headers present
• Dependency audit: zero Critical CVEs unpatched > 30 days
• Secrets not in git history (run gitleaks or trufflehog)

9.2 Infrastructure layer

• No public S3/GCS buckets with customer data
• IAM least privilege; no root access keys in use
• MFA enforced on all admin cloud accounts
• Supabase RLS enabled on all user-data tables
• TLS 1.2+ only; no expired certificates on subdomains
• CloudTrail or equivalent audit logging enabled

9.3 Compliance layer

• Privacy policy matches actual data collection
• Cookie consent before non-essential tracking (EU traffic)
• DPAs signed with all subprocessors handling PII
• Account deletion workflow tested and documented
• SOC 2 Type II verified in scope (if enterprise customers claimed)
• Incident response plan exists with 72h breach notification SLA

9.4 gitleaks secrets scan (run on cloned repo)

# Install: https://github.com/gitleaks/gitleaks
gitleaks detect --source ./cloned-repo --report-path gitleaks-report.json

# FAIL deal if findings include:
# - AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
# - stripe live keys (sk_live_)
# - database connection strings with production hosts
# - private keys (.pem, id_rsa)

# PASS with remediation if only revoked/test keys in old commits

10. Post-Close Security Hardening: First 14 Days

Security diligence does not end at close. Execute this sprint before announcing the acquisition or onboarding enterprise customers.

11. FAQ: Security Diligence for Digital Acquirers

What SRS score should make me walk away?

SRS above 3.5 unless you have a security turnaround thesis and $25k+ remediation budget. Between 2.6 and 3.5, price in full SRB plus 12–18% holdback. Below 1.5, proceed with standard credential rotation post-close.

Can I run a pentest on production without seller permission?

No. Unauthorized testing violates CFAA and equivalent laws globally. Always obtain written RoE. Use staging mirrors for buyer-side sprint work; reserve production testing for seller-authorized professional engagements only.

Is a SOC 2 badge enough for a $100k+ acquisition?

Never. Verify the report scope, entity, period, and exceptions. Cross- reference SOC 2 control descriptions against your cloud config audit— auditors routinely accept complementary subservice controls that leave application-layer gaps unaddressed.

How do I evaluate security if I am not a security engineer?

Hire a fractional security consultant for 6–8 hours ($800–$1,500). Provide the 4-hour sprint checklist and require SRS score plus SRB in writing. Never close on seller verbal assurances about “we were never hacked.”

Should security remediation reduce purchase price or come from post-close budget?

Both. Price reduction reflects pre-existing seller negligence (SRB + SRS penalty). Post-close budget covers execution and credential rotation. Use escrow holdbacks to align seller incentives for pre-close Critical remediation.

Does GDPR matter if the target has no EU customers today?

Yes, if you plan geographic expansion or the product could attract EU users organically. GDPR compliance debt is cheaper to fix pre-close when seller still has operational context. Budget $5k–$15k for first-time compliance if gaps exist.