My friend skipped one step in vendor due diligence, and it cost them $67K and three months. Here's what it was
Six months ago, I met one of my friends who was the CTO of an early-stage SaaS company. They had a product idea, roughly $150K in seed runway, but no mobile dev capability in-house. They hired an offshore agency in three weeks.
They were idiots.
Not because they went offshore. That wasn't the problem. The problem was that they spent more time comparing hourly rates than verifying a single reference.
By month four, they had burned $67K. The app worked in demos, but outside demos, it crashed consistently on iOS 13, had no automated tests worth mentioning, and when they asked how maintainable the codebase was, the agency's answer was: "It's complex, you'll need us for ongoing support."
That last sentence was the tell.
They brought in an external dev to audit the code. He spent two hours and came back with a list I still have saved. No CI/CD pipeline. Test coverage is sitting at roughly 11% on core business logic. Three screens had no error handling at all. The app was technically functional, the way a car with no brakes is technically a car.
Getting out cost them six more weeks and $8K in legal fees. They rebuilt with a different firm.
Here's the step they skipped: reference verification done with real questions.
They did call references and asked the questions they were supposed to ask: "How was the quality?" "Would you work with them again?" Everyone gave them the polished version.
What they never asked: What went wrong during the engagement, and how did the vendor respond?
That question breaks the script. A vendor with a good track record will have a real answer, something that went sideways, what they did about it, and what the outcome was. A vendor who bullshits will give you a non-answer. And now you know something important before signing anything.
The second thing they skipped was a paid discovery sprint. Most offshore agencies will do a 1–2 week paid sprint for $3,000–$5,000 before you commit to the full build. You get an architecture document, a database schema, and a technical spec.
More importantly, you get a real working sample. How do they communicate when blocked? Do they ask smart questions, or just start building? Do they escalate problems or disappear until the next check-in?
They thought they were efficient. But we were not.
There's one thing I still don't know: whether they would have caught the test coverage problem earlier, even with better due diligence. I think yes, but honestly, some vendors pass every check and still cut corners under schedule pressure.
Has anyone here actually walked away from a vendor after doing a paid discovery sprint? Curious whether it ever revealed enough red flags to justify not proceeding.