Woof. I didn't even notice the "for sale" part at first. That's probably the biggest red flag. You should never sell a backdoor into thousands of codebases to the highest bidder.

Of course, the real problem is thousands of codebases shouldn't be banking on the honor system for stuff like this.