10 due diligence questions to ask before buying a side project
A side project due diligence checklist you can paste straight into the inquiry message. What to ask, why it matters, and what a bad answer sounds like.
Most buyers I see on Failedups send a four word inquiry. “Is this still available?” Then they wonder why the seller goes quiet, or worse, why they end up with a half working repo and a domain stuck behind two factor auth on an account no one can log into.
A good inquiry message is a due diligence checklist. The seller either answers it, in which case you have everything you need to make an offer, or they dodge, in which case you have your answer.
Below are the ten questions I would paste into the message. Each one explains why it matters and what a bad answer sounds like. The buying side project checklist I wish more people used.
1. Why are you selling?
The single most important question, and the one most sellers answer badly.
A good answer sounds like: “I started a new role in January and I have not opened the repo since.” That is a calendar problem, not a product problem. You can buy a calendar problem cheaply.
A bad answer sounds like: “Just looking to recoup my investment.” That is sunk cost talking. The seller is anchored to what they spent, not what the project is worth. Expect a long negotiation.
2. What does the build and run cost per month?
Real numbers, with screenshots if possible. Vercel hobby tier vs pro. Supabase free vs the $25 plan. The OpenAI bill that quietly ballooned to $180 a month because someone left a prompt loop running.
A bad answer is “basically free” without receipts. I have inherited a “basically free” project that turned out to be costing the previous owner $90 a month across five services. You want to know your gross margin before you take over, especially if there are any paying users.
3. Who owns the domain and how does the transfer work?
This is where deals die. The domain might be on a personal Namecheap account that also hosts the seller’s wedding website. It might be on Cloudflare with a registrar lock. It might be a .ai registered through some reseller that requires a passport scan to transfer.
Ask: which registrar, what is the auth code timeline, and is there any cost to push it. If the seller cannot answer in one message, that is a red flag. Domains have killed more handovers than buggy code ever has.
4. What is broken right now?
Phrased exactly like that. Not “any known issues” because that invites a marketing answer. “What is broken right now” gets you the truth.
You want to hear specifics. “The Stripe webhook silently fails on subscription cancellation, I have a TODO in the code.” That is honesty. “Nothing major, just polish stuff” is a sentence buyers should treat as a yellow flag at minimum.
5. Are there any unfinished migrations?
Database migrations that were started but not run. A half completed move from Auth0 to Clerk. A Postgres column rename that exists in the schema but not in the seed data. These take days to untangle if you find them after the wire transfer.
A great seller volunteers this. Most do not. Asking directly forces them to think about it, and if they say “now that you mention it…” you have saved yourself a weekend.
6. Can I get read only access to the repo before paying?
This is the hill I will die on for SaaS acquisition checklist purposes. You should never wire money before reading the code.
Read only GitHub access takes thirty seconds to set up. If a seller refuses, the deal is over. There is no good reason to keep the code hidden when the buyer has signed an NDA and made a serious offer. The only reason to refuse is that the code is much worse than the README suggests.
What you are looking for: commit cadence, last meaningful change, presence of tests (any tests, even one), and whether the README would let you boot it locally.
7. What does deployment look like?
“Push to main, Vercel auto deploys” is one answer. “I run a script on my laptop and SCP the build to a DigitalOcean droplet I named bobcat3” is a very different answer.
Ask for the deploy story end to end. Where does the build run, how do environment variables get injected, what happens when the deploy fails. If the answer involves the seller’s personal SSH key, plan for a full migration as part of the handover.
8. Any third party API keys baked in?
Hardcoded keys are a nightmare. Sometimes literal strings in the source. Sometimes a .env that got committed once and is technically still in the git history. Sometimes a config service paid for by the seller’s employer.
Ask the seller to list every third party service, who pays for it, whose email is on the account, and whether MFA is enabled. Then ask if they can rotate everything before handover. If they say “the keys are fine, I trust you,” insist on rotation anyway.
9. Have you ever charged a real customer?
Even one dollar. Once.
The leap from zero paying customers to one paying customer is bigger than the leap from one to one hundred. If the seller has charged real money, even just a $9 lifetime deal to a friend, the Stripe account is configured, the legal entity exists somewhere, the tax setup has been thought about. If the answer is “no, never,” you are buying an MVP, not a business. Price accordingly.
10. What would you do differently if you started this project today?
The closing question, and my favorite. It tells you whether the seller has actually thought about the project or whether they just want it gone.
A great answer reveals the founder’s hard won lessons. “I would not have built the dashboard. Nobody used it. I would have started with email digests instead.” That is gold. Three months of learning, handed to you in two sentences.
A bad answer is “honestly, not much.” That tells you the seller did not reflect, did not learn, and probably will not be useful when you have follow up questions a month into the handover.
These ten questions take a serious seller thirty minutes to answer. If they do, you have everything you need to make a confident offer. If they do not, you saved yourself a regrettable wire transfer.
Want to practice? Browse a few active listings and try drafting an inquiry. Sellers who answer all ten well are usually the ones whose deals close.