How do I find out which outside code libraries a SaaS product depends on?

Most software leans on code written by others. The seller should be able to produce a complete list from the project’s build files, including the libraries those libraries pull in. Ask for it to be created fresh during your review, and keep a copy. A hand-written list is a starting point at best.

Then read the licence for each item. Some allow almost any use, while others attach conditions that may matter if the product is sold or kept private. Your lawyer is the right person to read the terms and tell you which ones need attention. Ask your technical adviser to flag libraries that have not been updated in a long time or that the author has dropped.

Check how the team keeps up. Do they update regularly, run automated checks for known flaws and note which parts are risky? If the product handles personal information, a weak library can become a breach, so ask whether any incident has occurred. Also ask about outside services the product calls, and what happens if one of them changes its price or shuts down. Ask for the same exercise to be repeated close to closing. New libraries are added all the time, and the list you saw at the start may not match the product you actually take over.

Key takeaways

• Ask for a dependency list generated from the build files.
• Have your lawyer read the licence terms for each library.
• Look for abandoned or outdated libraries and ask how updates are handled.