Fx

Field study · 200 listings · 4 September 2026

92% of businesses for sale had a security hole we could find from the outside…

We ran the scanner that runs on any URL you submit against 200 businesses listed for sale on Flippa. No seller was told. Nothing was tidied up first.

What came back

184 of 200 had a hole.

92 in 100
  1. 184flagged
  2. 16clean
  3. 558findings in total
  4. $300–$975to fix the median site
Show all 558 findings by severity
  • 193high
  • 32medium
  • 329low
  • 4info

No critical findings in the sample. High is a hole a buyer would want closed before wiring money; low is hygiene.

What was wrong

Two findings account for most of it.

  1. 56%Site is not served over HTTPS113 sites
  2. 56%Missing HTTP security headers111 sites
  3. 25%Multiple UI controls wired to nothing50 sites
  4. 23%Cookies set without baseline protective flags45 sites
  5. 18%Action controls that trigger no backend call36 sites
Show the other 13 findings
  1. 14%Unauthenticated AI endpoint (open LLM billing)27 sites
  2. 10%Permissive CORS policy19 sites
  3. 10%Admin path is publicly reachable19 sites
  4. 8%API route returns data without authentication15 sites
  5. 7%JavaScript source maps are publicly served13 sites
  6. 6%Google API key exposed in client-side code12 sites
  7. 5%Session cookie is readable by JavaScript (no HttpOnly)10 sites
  8. 3%Directory listing is enabled5 sites
  9. 3%AI endpoint detected — verify it is authenticated5 sites
  10. 2%The site refused connections from the scanner4 sites
  11. 2%Forgotten non-production deployments are publicly reachable3 sites
  12. 2%Insecure (HTTP) resources on an HTTPS page3 sites
  13. 1%Placeholder / unbuilt-feature content in the live UI2 sites

Who it happened to

Every kind of listing. Same result.

  1. 2.7Ecommerce80 sites
  2. 2.8SaaS53 sites
  3. 2.8Content49 sites
  4. 2.9Service14 sites
  5. 2.7Marketplace3 sites
  6. 4.0Agency1 site

Findings per site, averaged within each type. Bars are drawn against the highest of them, not against the whole sample.

Show the checks that could not run

A check that could not run is not a check that passed. Kept in view, never dropped.

  1. 66%Forgotten staging and preview sites still live132 sites
  2. 32%Data endpoints open without signing in63 sites
  3. 31%Secrets in archived copies of the site62 sites
  4. 28%Original source code published with the app57 sites
  5. 28%Unprotected AI endpoints anyone can run up a bill on55 sites
  6. 26%Folders browsable by anyone52 sites
  7. 26%Session cookie protection51 sites
  8. 25%Default admin pages still reachable49 sites
  9. 24%Browser security headers47 sites
  10. 24%Who other sites are allowed to read from this one47 sites
  11. 22%Git repository served to the public43 sites
  12. 20%Environment file left on the server40 sites
  13. 20%Dependency manifest served publicly39 sites
  14. 14%Insecure resources loaded on a secure page29 sites
  15. 3%API keys shipped inside the browser bundle6 sites
  16. 3%Buttons and features that do nothing6 sites
  17. 3%Firebase database readable by the world6 sites
  18. 3%Supabase tables readable with the public key6 sites

One site, in full

9 findings on one site. The median was 3.

Ecommerce, listed between $5,000 and $25,000. We are not naming it. Its listing is public; its security holes are not, and it is still for sale.

  1. Site is not served over HTTPS$75–$225

    Target resolved over http, not https.

  2. Session cookie is readable by JavaScript (no HttpOnly)$75–$225

    Session cookie(s) slv_session_51e5206f3949c44d60f98b7e879819e0 are set without HttpOnly, so any cross-site-scripting flaw can read them and take over accounts. Cookie values not captured.

  3. Unauthenticated AI endpoint (open LLM billing)$150–$600

    The endpoint /generators-portable-power proxies to a paid LLM API and accepted an unauthenticated request (no login required). Anyone can call it in a loop and run up the owner's API bill — an open, uncapped cost the buyer would inherit. Needs auth + rate limiting.

  4. Unauthenticated AI endpoint (open LLM billing)$150–$600

    The endpoint /ai-technology proxies to a paid LLM API and accepted an unauthenticated request (no login required). Anyone can call it in a loop and run up the owner's API bill — an open, uncapped cost the buyer would inherit. Needs auth + rate limiting.

  5. Unauthenticated AI endpoint (open LLM billing)$150–$600

    The endpoint /smart-life-with-ai proxies to a paid LLM API and accepted an unauthenticated request (no login required). Anyone can call it in a loop and run up the owner's API bill — an open, uncapped cost the buyer would inherit. Needs auth + rate limiting.

  6. API route returns data without authentication$75–$300

    An unauthenticated GET of /wp-json/ returned a JSON object containing personal-data fields — no login required. That is what one request observed, not necessarily the full size of the data set. The response carries personal-data fields, so this is broken access control: anyone can read it. Contents redacted.

  7. API route returns data without authentication$75–$300

    An unauthenticated GET of /wp-json/wp/v2/pages/48602 returned a JSON object containing personal-data fields — no login required. That is what one request observed, not necessarily the full size of the data set. The response carries personal-data fields, so this is broken access control: anyone can read it. Contents redacted.

  8. Missing HTTP security headers$75–$225

    Response is missing: HSTS, CSP, X-Frame-Options, X-Content-Type-Options. Missing headers are common — most sites we scan lack at least one — so treat this as baseline hardening to request, not as a deal issue on its own.

  9. Admin path is publicly reachable$75–$300

    /phpmyadmin/ returns 200. Confirm it enforces authentication.

How to check us

Check it yourself.

What these numbers do not cover
Sample bias
These are the newest, cheapest Flippa listings, many of them $1 opening auctions. They under-represent established, higher-value businesses. Read the rates as indicative of the low end of the market, not the whole of it.
Pricing is uncalibrated
Fix-cost and expected-loss figures come from a documented but un-tuned model. Use them to compare findings against each other, not as absolute dollar truth.
“Could not run” is a result
Several checks need a successful crawl, so parked and dead sites make those checks report themselves unable to run rather than passing. That is signal, not a gap — a site a buyer cannot reach is itself a finding.
Redacted
Finding evidence is redacted where it was captured: a leaked key shows its type and last digits, never the secret. The scanned sites are not named, and the specimen below has had its address removed from every field, including the evidence text.