Your developer vanished, your agency went quiet, or you inherited a codebase nobody understands. Or it was built fast with AI tools and now it has to be real. Senior engineers take a hard, honest look and hand you a decision: rescue it, rebuild it, or stop. Onshore, no juniors.
A senior team that has opened more than forty codebases. The truth about yours, fast.
Your app works. We tell you whether you own it, whether it can be maintained, and whether it survives real users.
Keep your client. Get an independent, evidenced decision you can defend.
These arrive under different words. Codebase takeover, software project handover, a rescue. They are the same engagement: a senior team gets inside the code, the accounts and the infrastructure, and tells you where you stand.
You shipped fast on Lovable, bolt.new, Replit or Base44. A vibe-coded app that now has to be real. The thing runs, and the question underneath is quieter: do you own it, can anyone but the tool maintain it, and does it survive real users? A Cursor or Windsurf build lands in the same place.
A PM, a security lead, an intern, somebody technical enough hacked it together, and it has real potential. Building a proof and building for production are different jobs. We tell you what carries forward, what gets rebuilt, and what it takes to make it real.
The developer disappeared. The agency controls your accounts and stopped answering. You are locked out of your own app. First question we answer: can you deploy without the people who left?
The team is still in place, but the product is drifting and the answers are thin, and you're quietly weighing a change. We give you an independent read of where the thing actually stands, under NDA, before you say anything to anyone. Discretion is the default.
A handover with no handover. Nobody understands the code, and you need to know what running it actually takes, and who holds the repos, the cloud accounts and the keys.
Maybe it limps along, maybe it is stalling under real users. You need a straight answer, rescue it, rebuild it, or stop, with what each one costs.
The assessment prices the look, not the rescue. You get a written report and a live readout call. It leads with the decision and with who owns what, because those are the two things a code scanner structurally cannot tell you.
Rescue, rebuild, or, where it is the honest answer, stop and contain. Three options, costed with their assumptions, so you can see why the recommendation is the recommendation.
Repos, environments, domains, cloud, app store accounts, signing keys, credentials, third-party services, billing. Who holds each one today, and what that means for you.
What is kept, what is binned, and why.
Severity, impact and remediation effort per finding, scoped to what bears on the decision. Not a full technical-debt inventory.
What was reviewed, what could not be inspected, what was assumed, and the limits of a fixed-days look, stated plainly.
Sequenced. Stabilise, secure, then fix, itemised well enough that any competent firm could price the same plan. For AI-built products it includes the platform question: what stays in the tool, what moves to a repo you own, and what a normal engineer needs to take it over.
The plain-English layer for a board member, an investor, a bank or a solicitor, kept separate from the technical detail.
Architecture sketch, deploy path, dependency snapshot, and our confidence level on the estimates.
Critical findings the day we find them. If day one turns up leaked keys or an open database, you hear it that working day, in writing, as an interim advisory.
The report inside a week. The look takes two to seven working days. The written report lands within two working days of the look finishing.
Typically $5,000 to $9,000. €4,500 to €8,000 in Ireland, the UK and the EU.
This is the founder and SME look. One product, a handful of services, a team that was under ten. Larger estates get a separate conversation.
The number inside the band is set in a short scoping call, in your currency. What moves it: how many platforms and codebases, the size and age of the thing, whether it holds sensitive data, and whether you hold your own keys.
The assessment is phase one of any fix or rebuild we do, so the assessment fee comes off the first invoice for that work, up to $5,000 (€4,500 in Ireland, the UK and the EU). The findings are the findings regardless: severity is independent of who does the work, and the report is yours to take anywhere.
If you want us to, the rescue itself, the fix or the rebuild, is a normal project. We scope and price it after the assessment, in the conversation, never off a menu on this page.
The severity of a finding does not change based on whether we do the fix. The report is yours, and you can take it to anyone.
For a buyer who has been burned once, this matters more than the price. So it is a written protocol, not a promise. You get it before any engagement letter.
Where the keys sit with a vanished vendor and have to be recovered first, we name and scope that separately, and it happens before the assessment clock starts. We never absorb it silently.
You have real users or real money at risk, an ownership or a survivability question, and the budget to act on the answer. You want a decision you can defend, not a patch over the top.
There are no real users and no sensitive data, no ownership problem, and no budget for the fix if fixing is the answer. A two-thousand-euro tidy-up is a different job, and we will say so.
The standard assessment does not buy regulated assurance. A genuinely regulated product, a medical device or similar, moves to separately scoped work. We say that plainly rather than wave it through.
Brought in by a founder to shortlist? You keep the client and get an independent, evidenced decision you can put your name to.
Fourteen years of builds where getting it wrong was expensive, and more than forty codebases opened and assessed since 2012. Rescue is not a sideline here. Some of our clearest wins started as a rescue that came in by referral.
One founder came to us with no budget for a full audit. We ran the assessment as phase one. Once the problem was actually understood, they committed to a fix several times the size of the assessment fee, with the money going where the problem actually was.
A sample report shows the depth, the registers and the severity scale we work to. The same eye reads your code the same way.
We plan for it. Where the credentials sit with a vanished vendor, we name and scope the recovery separately, and it happens before the assessment clock starts. We never absorb it silently.
No. The report is yours to take anywhere, and the severity of a finding does not change based on who does the work. If you want us to do the fix, we scope it separately after the assessment.
We say so plainly. The evidence map records what could not be inspected and what we assumed, and it states the limits of a fixed-days look. We do not dress a guess up as a finding.
Read-only by default, credentials you create and revoke, an NDA before anyone sees code, and no production change without your written approval. You hold the switch throughout.
The standard assessment does not buy regulated assurance. A genuinely regulated product, a medical device or similar, moves to separately scoped work, and we tell you that up front.
Work typically starts within two to three working days of access being confirmed. Critical findings are flagged the same working day we find them, in writing.
From $5,000, typically $5,000 to $9,000, and €4,500 to €8,000 in Ireland, the UK and the EU. The number inside the band is set in a short scoping call, in your currency.
It starts with a short call, and we qualify hard before we take founder time: your users and your revenue, how urgent it is, what access you can grant, where the previous team stands, and whether any of this is already heading for a solicitor. A senior engineer, not a sales layer.
We answer the awkward questions directly: how we protect your code and your accounts, how we handle a vendor who will not cooperate, insurance, continuity and references.
Best fit is a founder or a small team with a product that has real users or real money behind it, and a decision to make about saving it. If it is a two-thousand-euro tidy-up, we will tell you.