In a SaaS model, you will likely not be able to perform code audits. This is because as stated, it is Software as a Service. Not software where you would be able to download the software itself, let alone the source code for the software. That task would be done at the discretion of the software vendor, and or provider. Please see "5 Problems with SaaS Security"
So I will document issues I have with SaaS, and SaaS Security.
- Access - Who is accessing this. Is it just my organization. Is it a
multi-tenant software. Would there be any overlap.
- Auditing - How can I audit this at will. Where are the logs stored, how can I modify this to my business (data retention)
- Security - while I may not be able to audit code, how can I test for the low hanging fruit (known known vulnerabilities, configuration issues, etc)
Security when it comes down to software you purchase is never your responsibility. When you buy a car, and the automaker tells you they went through (in the US at least) IIHS (Insurance Institute for Highway Safety) testing that established a baseline of safety, have you ever said: "I don't believe them, I need to crash my car for myself to make sure the airbag deploys." Many larger SaaS vendors have security measures, and testing in place. (Google, Microsoft, Salesforce, etc)
So let's put this into an alternative view now. You test the software, find vulnerabilities. So what. Now what. Do you fix them on your own? What makes you think a SaaS provider would allow you to randomly test their software "pre purchase." There has to be some level of trust, and while it can be said: "Trust but verify" in the business world, this is where Service Level Agreements, and Terms of Service agreements come into play to mitigate/transfer the risk.
Many SaaS providers do take security serious for example see Microsoft's stance on this:
Office 365 and Microsoft Dynamics CRM Online internal monitoring
includes automated compliance monitoring of infrastructure (e.g.,
vulnerability scans, penetration testing and testing of process and
people controls). The Office 365 and Microsoft Dynamics CRM Online
third-party validation program includes independent audits that are
conducted on an annual basis to provide verification of Office 365 and
Microsoft Dynamics CRM Online's security posture.
What exactly is it you are trying to accomplish? Trying to be the security team for a vendor?