DEV Community: Adil Soukaini | Full-Stack Developer

AI Coding Assistants and Productivity: What the Research Actually Says

Adil Soukaini | Full-Stack Developer — Sat, 07 Nov 2026 09:00:04 +0000

Originally published on shipfastdev.com.

The research on AI coding assistants does not give one number. Controlled experiments on well-defined tasks show large speedups (55% faster in GitHub's 2022 study), field experiments in companies show a smaller but real gain (about 26% more completed tasks), and the best-known randomised trial on experienced developers working in their own large codebases found they were 19% slower with AI. At team level, Google's DORA research finds more throughput but less stability.

Here is what each major study measured, why they disagree, and how to use the evidence when you plan a roadmap or judge a developer's estimates.

The main studies, side by side

GitHub's controlled experiment (2022)

GitHub asked 95 professional developers to write an HTTP server in JavaScript. Those using Copilot finished in 1 hour 11 minutes on average, against 2 hours 41 minutes without it: 55% faster. 78% of the Copilot group completed the task, against 70% without. This is the source of the often-quoted "55%" figure. It measured one greenfield, clearly specified task, which is close to the best case for an assistant.

Field experiments at Microsoft, Accenture and a Fortune 100 company

A team of economists (Cui, Demirer, Jaffe, Musolff, Peng and Salz) randomly gave some developers access to an AI coding assistant in their normal jobs. Across the three experiments and 4,867 developers, the tool led to a 26.08% increase (standard error 10.3%) in completed tasks. Less experienced developers adopted the tool more and gained more.

METR's randomised trial with experienced open-source developers (2025)

METR recruited 16 experienced developers from large open-source repositories they already maintained. Each of 246 real issues (about two hours each) was randomly assigned to "AI allowed" or "AI not allowed". The main tool was Cursor Pro with Claude 3.5/3.7 Sonnet. With AI, tasks took 19% longer. Before starting, the developers expected a 24% speedup; after finishing, they still believed AI had sped them up by 20%. METR is careful to say the result does not show AI fails everywhere, only that it slowed these developers on this kind of work at that time.

METR's follow-up (February 2026)

METR ran a larger study from August 2025 with 57 developers, 143 repositories and more than 800 tasks. The estimated speedup was 18% for returning developers (confidence interval from a 38% speedup to a 9% slowdown) and 4% for newly recruited ones (from 15% faster to 9% slower). METR itself calls this an unreliable signal: many developers refused to take part because they did not want to work without AI, 30% to 50% avoided submitting tasks they expected AI to speed up a lot, and pay dropped from $150 to $50 an hour. METR is changing its study design rather than publishing a headline number.

Google's DORA report (2025)

The 2025 DORA report surveyed nearly 5,000 technology professionals. AI adoption reached 90%, with a median of two hours a day spent working with AI. Over 80% said AI improved their productivity and 59% said it improved code quality. On delivery metrics, Google's DORA team found a positive relationship between AI adoption and software delivery throughput, but AI adoption "does continue to have a negative relationship with software delivery stability."

Where the gains show up

Self-contained, well-specified tasks, like the HTTP server in the GitHub experiment.
Less experienced developers, who gained the most in the field experiments.
Team throughput: DORA links AI adoption to teams shipping more.
Developer sentiment: in the 2025 Stack Overflow survey, 84% of respondents were using or planning to use AI tools, and 60.7% viewed them favourably.

Where they don't

Experts in large codebases they know well, the METR 2025 setting. Context, conventions and quality standards that live in a maintainer's head are hard to hand to a model.
Stability. DORA's explanation is that AI increases change volume, and "without robust control systems, like strong automated testing, mature version control practices, and fast feedback loops, an increase in change volume leads to instability."
"Almost right" code. 66% of Stack Overflow respondents named "AI solutions that are almost right, but not quite" as their top frustration, and 45.7% distrust the accuracy of AI output against 32.3% who trust it.
Self-assessment. METR's developers felt 20% faster while measuring 19% slower. Opinions about AI speed are not evidence.

Why the studies disagree

They measure different things. GitHub timed one task. The field experiments counted completed tasks in developers' day-to-day work. METR timed real issues in mature projects, with screen recordings. DORA relies on surveys linked to delivery metrics. The populations differ too (professionals on a test task, employees at large companies, open-source maintainers), as do the tools, which have improved quickly between 2022 and 2026. None of these studies is wrong; they answer different questions.

What this means for your product team

Measure delivery, not impressions. Track how long changes take to reach production, how often you deploy, how often a release breaks something, and how much work gets redone. If you work with a remote developer, a weekly release rhythm makes these numbers visible.
Put tests and CI in place before pushing more AI-generated code. DORA's finding on stability is a direct warning. Automated end-to-end tests, such as the Playwright setup we describe here, are the kind of control system it refers to.
Don't cut estimates in half because of a vendor figure. A realistic planning assumption sits somewhere between the field-experiment gain and no gain at all, depending on the codebase and the developer.
Budget review time. More code means more to review, and AI-generated code has its own security failure patterns.
Watch for debt. Code that is "almost right" and merged anyway becomes technical debt.

Frequently asked questions

Do AI coding assistants make developers faster?

Often, but not always. Studies range from 55% faster on a single controlled task to 26% more completed tasks in company field experiments, while METR's 2025 trial found experienced developers 19% slower in their own large codebases.

Did the METR study show AI slows developers down?

For 16 experienced open-source maintainers working on their own repositories in early 2025, yes: tasks took 19% longer. METR does not generalise this to all developers, and its 2026 follow-up was too affected by selection bias to give a reliable new estimate.

How much productivity gain should a startup plan for?

Plan conservatively and measure. The company field experiments found about 26% more completed tasks on average, with bigger gains for less experienced developers. Your result depends on task type, codebase and testing practices.

Should I require my developers to use AI tools?

Adoption is already near universal (90% in DORA 2025). The more useful requirement is on outcomes: tests, code review and stable releases, whatever tools are used.

Sources

Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity, METR, 2025-07
We are Changing our Developer Productivity Experiment Design, METR, 2026-02
Research: quantifying GitHub Copilot's impact on developer productivity and happiness, GitHub, 2022-09 (updated 2024-05)
The Effects of Generative AI on High-Skilled Work: Evidence from Three Field Experiments with Software Developers, Microsoft Research (Cui, Demirer, Jaffe, Musolff, Peng, Salz), 2025-06
Announcing the 2025 DORA Report, Google Cloud, 2025-09
How are developers using AI? Inside our 2025 DORA report, Google, 2025-09
2025 Developer Survey: AI, Stack Overflow, 2025

Security Risks of AI-Generated Code: Research and a Review Checklist

Adil Soukaini | Full-Stack Developer — Fri, 06 Nov 2026 09:00:04 +0000

Originally published on shipfastdev.com.

AI-generated code usually works, but it is often not secure. In Veracode's 2026 tests, models produced code that compiled almost 100% of the time, yet failed security checks on nearly 44% of tasks, a pass rate that has not improved since 2025. The fix is not to ban AI tools; it is to treat their output like code from a contractor you have never worked with: review it, scan it, and test it before it reaches production.

Below is a summary of the research, the failure patterns that come up again and again, and a review checklist you can hand to your developer or agency.

What the research found

Veracode: about half of security-relevant tasks fail, and it is not improving

In its 2025 GenAI Code Security Report, Veracode gave 80 curated coding tasks to more than 100 large language models. When a secure and an insecure approach were both possible, models chose the insecure one 45% of the time. Java was the riskiest language, with a security failure rate above 70%; Python, C# and JavaScript failed between 38% and 45% of the time. Models failed to defend against cross-site scripting in 86% of cases and log injection in 88%. Larger models did not perform significantly better than smaller ones.

The 2026 edition found the average security pass rate "sits at 56 percent — virtually unchanged since last year's report." The best model on its summer 2026 leaderboard reached 68%, which still means failing nearly one security task in three. Python code passed 63% of the time, Java only 30%. Coding-specialised models (51%) did no better than general-purpose ones (52%), and model size made no clear difference, although reasoning models kept an edge (56% against 51%).

Academic studies: vulnerable suggestions and overconfident users

An early study of GitHub Copilot, "Asleep at the Keyboard?" (IEEE Symposium on Security and Privacy 2022), generated 1,689 programs across 89 security-relevant scenarios and found approximately 40% of them vulnerable.
A user study published at ACM CCS 2023 found that participants with an AI assistant wrote significantly less secure code than those without, and were more likely to believe their code was secure.
A USENIX Security 2025 paper analysed 576,000 code samples from 16 models and found that at least 5.2% of packages suggested by commercial models and 21.7% by open-source models did not exist, with 205,474 unique invented package names. An attacker can publish a malicious package under a name that models tend to invent, and anyone who installs it without checking is compromised.

Team level: more changes, less stability

Google's 2025 DORA report found that AI adoption is linked to higher delivery throughput but still has a negative relationship with delivery stability. Its explanation applies directly to security: without strong automated testing and fast feedback loops, more change volume leads to more incidents.

Why AI-generated code fails security checks

Security usually depends on context the model does not have: which input comes from an untrusted user, who is allowed to see which record, which secrets exist in your environment. Cross-site scripting, which depends on knowing where a piece of data will be displayed, had one of the worst results in Veracode's 2025 tests (86% failure). The model writes code that does what you asked; whether it is safe depends on what you did not say.

The failure patterns to look for

Untrusted input reaching output or queries: cross-site scripting, SQL injection, log injection.
Missing authorisation checks: an endpoint that checks the user is logged in, but not that the record belongs to them.
Secrets in code: API keys pasted into source files or front-end bundles.
Invented or outdated dependencies: packages that do not exist, or old versions with known vulnerabilities.
Insecure defaults: permissive CORS, debug mode on, verbose error messages in production.
Weak cryptography or home-made auth instead of the framework's built-in tools.

A security review checklist for AI-generated code

You don't need to read code to use this list. Ask your developer to confirm each point for every feature that touches users, payments or data. Items 1 to 4 apply before any change is merged, 5 to 7 cover dependencies and secrets, and 8 to 12 cover testing and process.

A human who understands the code has reviewed every AI-generated change, line by line.
Every endpoint checks authorisation (who can access this record), not just authentication.
All user input is validated on the server, and output is escaped by the framework (no raw HTML rendering of user content).
Database access uses the framework's query builder or parameterised queries, never string-built SQL.
Every new package was checked: it exists, is maintained, and is the one the developer meant to install.
A dependency audit runs automatically (for example npm audit, composer audit or GitHub Dependabot).
No secret is committed to the repository or shipped to the browser; secret scanning is enabled.
Automated tests cover login, permissions and payment flows, and run on every change. End-to-end tests such as the Playwright setup we use catch broken access rules early.
A static analysis (SAST) tool runs in CI on every pull request.
Production runs with debug off, restrictive CORS and generic error pages.
AI agents cannot touch production data or credentials directly.
Someone owns security decisions, and you know who.

Questions to ask your developer or agency

Which AI tools do you use, and what is your review rule for their output?
What runs automatically on every pull request: tests, dependency audit, static analysis, secret scanning?
How are authorisation rules tested?
Who would notice if a new package did not exist yesterday?

These questions belong in any evaluation of a development partner. If your app was built mainly with an AI app builder, read where vibe-coded MVPs break as well: missing data-access rules are the most common problem there.

Frequently asked questions

Is AI-generated code secure?

Not by default. Veracode's 2026 tests found an average security pass rate of 56%, unchanged from 2025, even though almost all generated code compiled. It needs the same review and testing as any other code, and arguably more.

Which programming language is riskiest for AI-generated code?

In Veracode's tests, Java: a 30% security pass rate in 2026, against 63% for Python. Language matters less than review, though: every language failed a significant share of tasks.

Can an AI tool review its own code for security?

It can help spot issues, but the same models chose insecure options in a large share of Veracode's tasks. Use AI review as one layer, alongside static analysis, dependency audits, tests and a human reviewer.

Do I need a security audit for my MVP?

If it handles personal data, payments or logins, at least run through the checklist above before launch. A full external audit makes sense once you have real users or sensitive data at scale.

Sources

LLMs Are Getting Smarter but Not Safer: Veracode 2026 GenAI Code Security Report, Veracode, 2026-07
AI-Generated Code Poses Major Security Risks in Nearly Half of All Development Tasks, Veracode Research Reveals, Veracode, 2025-07
Asleep at the Keyboard? Assessing the Security of GitHub Copilot's Code Contributions (IEEE S&P 2022), Pearce, Ahmad, Tan, Dolan-Gavitt, Karri (arXiv), 2021-12
Do Users Write More Insecure Code with AI Assistants? (ACM CCS 2023), Perry, Srivastava, Kumar, Boneh (arXiv), 2023-12
We Have a Package for You! A Comprehensive Analysis of Package Hallucinations by Code Generating LLMs (USENIX Security 2025), Spracklen et al. (arXiv), 2025-03
Announcing the 2025 DORA Report, Google Cloud, 2025-09

Deploying a Laravel app on Google Cloud Run: the pitfalls and the fixes

Adil Soukaini | Full-Stack Developer — Wed, 04 Nov 2026 09:00:04 +0000

Originally published on shipfastdev.com.

To deploy a Laravel app on Google Cloud Run, you put PHP-FPM and a web server in one container that listens on the port Cloud Run gives it, build your frontend assets before the image, keep configuration on the service rather than in your CI file, and tell Laravel it runs behind an HTTPS proxy. Most of the work is in a handful of Laravel-specific traps; here are the ones we hit putting Driveway Morocco into production, and the fixes.

Driveway Morocco is ShipFastDev's car-rental platform (case study): Laravel 13 with an Inertia/React storefront, a Filament admin panel, Stripe deposit holds, and plugins (fleet, booking, payments) installed as local Composer packages. It went live on Cloud Run in August 2026, with a managed Postgres database on Supabase and GitHub Actions deploying on every push to the main branch. Every pitfall below comes from that deployment's commit history.

What Cloud Run expects from your container

Read the container runtime contract before you write the Dockerfile. Four rules matter most for a Laravel app:

Port. The container must listen on 0.0.0.0 on the port in the PORT environment variable. Requests are sent to 8080 by default.
No TLS inside the container. Cloud Run terminates HTTPS and proxies requests to your container as plain HTTP. Laravel has to be told about it, or it builds http:// links.
The filesystem is memory. Writing to disk uses the instance's RAM and disappears when the instance stops. Sessions, uploads and logs belong in the database, object storage or stdout.
Startup and shutdown limits. An instance must listen for requests within 4 minutes of starting. On shutdown it receives SIGTERM, then SIGKILL 10 seconds later.

Driveway runs a single image with PHP 8.4 FPM, Nginx and Supervisor. Nginx listens on the port, serves the built assets and hands PHP requests to FPM.

Pitfall 1: frontend assets missing from the build

With gcloud run deploy --source ., your directory is uploaded and built by Cloud Build using your Dockerfile if one is present. What gets uploaded is decided by .gcloudignore, and the default file pulls in your .gitignore. Vite writes its output to public/build, which is gitignored, so the first CI deploys shipped an image with no compiled CSS or JavaScript.

Running npm ci && npm run build inside the image did not fix it cleanly: the build regenerated manifest.json with new hashes but no matching JS files. The working setup builds the assets in the CI job before the deploy step, and the Dockerfile only copies public/build. Removing Node and npm from the image also made it about 200 MB smaller.

Pitfall 2: your local vendor/ overwriting the real one

The Dockerfile runs composer install and then copies the source. Because vendor/ was not listed in .gcloudignore, COPY . replaced the freshly installed dependencies with the developer's local vendor/, and the Filament admin routes broke. Exclude vendor/ and node_modules/ from the upload; the image should install its own dependencies from the lockfile.

Pitfall 3: Composer path repositories and symlinks

Driveway's plugins live in a plugins/ folder and are installed as Composer path repositories. Composer symlinks path packages by default. Inside the Docker build, the copy turned those symlinks into real directories, and the autoloader stopped finding plugin classes. Vehicle detail and checkout pages, which depended on plugin routes, rendered blank.

The fixes in the history were pragmatic: a build step that adds the plugins' PSR-4 namespaces to Composer's autoload map, a core-owned fleet controller, and core fallback routes for the booking flow. The image also needed the intl, zip and gd extensions for composer install to succeed. If you are starting fresh, try Composer's "symlink": false option first: the Composer documentation notes that forcing mirroring "can be useful when deploying".

Pitfall 4: layer caching that breaks the build

Docker's advice is to copy the package files, install dependencies, then copy the source. A commit applied that order (copy composer.json and plugins/, install, then copy the rest) and estimated typical deploys would drop from about 8 minutes to about 2. It was reverted the same day because the new order broke CI builds: with path repositories, the dependency layer depends on your own plugin code too. Get a working image first, then optimise, and prove the change with a real CI build.

Pitfall 5: http:// links behind the HTTPS proxy

This one took the whole storefront down. PHP-FPM saw plain HTTP, so Laravel's url() helper produced http:// URLs for assets and API calls. The page was served over HTTPS, so the Content Security Policy blocked those requests: navigation, login, search, filters and booking all stopped working, with no server error to point at.

The fix was to make Laravel generate HTTPS URLs: set APP_URL and ASSET_URL to the public domain, force HTTPS in the startup script, and call URL::forceScheme('https') in production. The Laravel documentation describes the standard route: enable the TrustProxies middleware so Laravel reads the forwarded protocol, and use * when you don't know your load balancer's addresses.

// bootstrap/app.php
->withMiddleware(function (Middleware $middleware): void {
    $middleware->trustProxies(at: '*');
})

Either way, check it in a browser with the console open.

Pitfall 6: secrets in the CI file

The first workflow passed environment variables in the deploy step, including the database password and the app key. They were removed within the day. Cloud Run carries a revision's configuration into the next revisions unless you change it explicitly, so the pipeline only needs to ship a new image. Two details from the same page: --set-env-vars deletes every variable you don't list, while --update-env-vars only adds or changes; and Google does not recommend environment variables for secrets such as database credentials or API keys, pointing to Secret Manager instead.

For authentication, the pipeline first used a service account key stored as a GitHub secret. In September 2026 it moved to Workload Identity Federation with Google's deploy action. The google-github-actions/auth documentation recommends federation because it "obviates the need to export a long-lived credential"; a key file never expires and must be treated like a password. The workflow needs the id-token: write permission.

Pitfall 7: cold starts and memory

A new instance starts from the image, so anything cached at build time can be stale. Driveway's startup script clears the config and route caches so the plugin manager reads which plugins are enabled from the database, and runs php artisan package:discover so Laravel registers installed packages. Keep this script short: it runs on every cold start, and the instance has 4 minutes to start listening.

Memory is the other limit. The default is 512 MiB per instance, instances that exceed their limit are terminated, and files written to disk count against it. Driveway's service was raised to 1 GiB for stability.

Pitfall 8: one admin feature taking down every page

In September 2026, a plugin registered an admin-only Filament/Livewire component in its boot() method. In the Cloud Run boot context that call threw, and because the exception happened during application boot, every page failed, storefront included. The error pages then called route('home'), which wasn't in the route list after the failed boot, so React unmounted and visitors got a white screen.

Two fixes: admin-only registration is wrapped in a try/catch so it is best-effort, and the error pages fall back to plain paths when a named route is missing. Boot code runs on every request; an error page must not depend on anything that can fail.

Queues and scheduled tasks

The project's production checklist lists a queue worker and the Laravel scheduler. A backend audit had already found that, without a worker, queued emails, push notifications and the deposit-hold expiry command silently never ran in the local Docker setup. On Cloud Run, plan this explicitly: under the default request-based billing, the container contract says CPU is allocated while instances process requests, so a queue:work process in the web container is not a reliable worker. The documented options are instance-based billing, which keeps CPU allocated for the instance's lifetime, or a Cloud Run job triggered by Cloud Scheduler for periodic commands.

The checklist

Nginx and PHP-FPM in one image, listening on $PORT.
Assets built in CI; no Node in the runtime image.
vendor/ and node_modules/ excluded from the upload.
Autoloading tested inside the built image.
HTTPS URLs verified in a real browser.
Secrets in Secret Manager, CI on Workload Identity Federation.
Short startup script, memory sized for the app.
Guarded boot code, error pages that always render.
A plan for queues and cron.
Browser tests before deploy: see end-to-end tests with Playwright in CI.

Most of these problems appeared only in the deployed container. Small, frequent deploys made each one easy to trace, as argued in weekly releases with a remote developer. The same project's search setup, with a fallback when the search engine is down, is covered in Laravel search with Meilisearch and a database fallback.

Frequently asked questions

Can Laravel run on Cloud Run without code changes?

Mostly. You need a container that listens on $PORT, Laravel configured to generate HTTPS URLs behind the proxy, configuration from environment variables or Secret Manager, and no reliance on the local disk for anything that must persist.

Do I need Nginx inside the container?

Cloud Run forwards HTTP to your container, and PHP-FPM speaks FastCGI, not HTTP, so a web server has to sit in front of it. Driveway Morocco uses Nginx and PHP-FPM under Supervisor.

How do I run Laravel queues and cron jobs on Cloud Run?

Not as a background process in the web container under request-based billing, because CPU is only allocated while requests are processed. Use instance-based billing for a worker, or Cloud Run jobs triggered by Cloud Scheduler for scheduled commands.

Why does my Laravel app on Cloud Run load assets over http://?

Cloud Run terminates TLS and sends plain HTTP to the container, so Laravel thinks the request is insecure. Trust the proxy with the TrustProxies middleware or force the HTTPS scheme in production, and set APP_URL to your https:// domain.

Sources

Container runtime contract, Google Cloud, 2026-09
Deploy services from source code, Google Cloud, 2026-09
gcloud topic gcloudignore, Google Cloud, 2026-10
Configure environment variables for services, Google Cloud, 2026-09
Configure memory limits for services, Google Cloud, 2026-09
Execute jobs on a schedule, Google Cloud, 2026-09
google-github-actions/auth, Google (GitHub), 2026-10
HTTP Requests: Configuring Trusted Proxies, Laravel 13.x documentation, 2026-10
Repositories: Path, Composer documentation, 2026-10
Optimize cache usage in builds, Docker Docs, 2026-10

How much does an MVP cost in 2026? Hours, rates and hidden costs

Adil Soukaini | Full-Stack Developer — Tue, 03 Nov 2026 09:00:08 +0000

Originally published on shipfastdev.com.

An MVP costs whatever its hours cost: the number of hours the scope needs, multiplied by the rate of the people building it, plus the running costs nobody puts in the quote. With the assumptions spelled out below, a single-flow web MVP comes to roughly 160–240 hours, a two-sided marketplace 400–600 hours, and adding iOS and Android apps pushes it to 700–1,050 hours. The rate you pay then turns those hours into anything from about $6,000 to well over $100,000.

This guide shows where those hours go, three example scopes with the maths visible, what to cut first, and the costs that arrive after launch.

What you are actually paying for

The Agile Alliance, quoting Eric Ries, defines an MVP as the version of a product that lets a team "collect the maximum amount of validated learning about customers with the least effort". The same page warns about the opposite mistake: shipping something so thin, or so buggy, that it teaches you nothing. Your budget should buy learning, not features.

In practice the hours go into five buckets:

Product and UX work: turning the idea into screens and flows a developer can build.
Frontend: the screens users touch, on web, mobile or both.
Backend: accounts, data, business rules, emails, payments, admin.
Integrations: payment providers, maps, calendars, third-party APIs.
Testing and release: QA, deployment, store submission, fixes after the first real users arrive.

The cost drivers that move the number most

Number of platforms. Web only is the cheapest. A web app plus native iOS and Android apps is the single largest multiplier. Cross-platform tools reduce it but do not remove it (see React Native vs Flutter).
Number of user roles. A product with one type of user is far simpler than a marketplace with buyers, sellers and an admin, each with their own screens and permissions.
Payments and money flows. A simple checkout is quick with a hosted payment page. Split payments, refunds, deposits and payouts to third parties are not.
Integrations. Each external API brings its own authentication, error cases and sandbox quirks.
Custom design. A clean UI built on an existing component library costs a fraction of a fully bespoke design system.
Real-time and offline features. Live chat, live tracking or offline-first mobile apps add both build time and infrastructure.
Languages and compliance. A second language doubles copy and testing. Health, finance or children's data adds legal and security work.

Three example scopes, with the maths shown

These are illustrations, not quotes or market data. The hour ranges are our own working assumptions for a competent small team using a mainstream stack (for example Laravel or Node.js with React, and Expo for mobile), a component-library UI, and one round of feedback. They include design, development, testing and deployment; they exclude branding, copywriting and marketing.

For rates we use three illustrative figures: $35, $65 and $120 per hour. For context, the US Bureau of Labor Statistics puts the median wage of US software developers at $64.44 per hour (May 2025 data). That is an employee's wage before employer overheads, not a contractor or agency rate; real rates vary a lot by country and seniority, which we cover in how much it costs to hire a software developer.

Scope A: a single-flow web MVP (160–240 hours)

Sign-up and login, one core workflow (for example "submit a request, receive a quote, accept it"), transactional emails, a basic admin view, responsive web UI, deployment.

At $35/h: $5,600–$8,400
At $65/h: $10,400–$15,600
At $120/h: $19,200–$28,800

Scope B: a two-sided marketplace on the web (400–600 hours)

Two user roles with profiles, listings with photos, search and filters, booking or order requests, online payment through a hosted checkout, email notifications, an admin area for moderation and refunds.

At $35/h: $14,000–$21,000
At $65/h: $26,000–$39,000
At $120/h: $48,000–$72,000

Scope C: Scope B plus iOS and Android apps (700–1,050 hours)

The same backend, plus a cross-platform mobile app with push notifications, store listings and two store review cycles. This is the shape of a product like the Driveway Morocco car-rental platform, which has a Laravel and React web platform and an Expo mobile app.

At $35/h: $24,500–$36,750
At $65/h: $45,500–$68,250
At $120/h: $84,000–$126,000

Use these to sanity-check a quote: divide the price by the rate and ask whether the resulting hours match the scope. If a quote implies 80 hours for Scope B, something has been left out. If it implies 2,000, ask what the extra work is.

What to cut first

The cheapest hours are the ones you never spend. Before asking for estimates, go through this list (and through our guide on how to scope an MVP):

The second platform. Start with a responsive web app, or with one mobile platform if your users are mobile-only.
Automation you can do by hand. Matching, approvals and onboarding can be manual for the first hundred users.
Complex payments. A hosted checkout or payment links can replace a custom payment flow until volume justifies it.
Custom dashboards. Use an analytics tool and a simple admin view instead of building reporting.
Settings, preferences and edge-case screens. Ship sensible defaults.
A bespoke design system. Use a well-made component library and invest in design once you know what users do.

If what you need is mostly forms, a database and workflows, compare against a no-code build first; our article on no-code vs custom development covers where that breaks.

The costs that are not in the build quote

App store accounts and rules

The Apple Developer Program costs 99 USD per membership year.
Google Play charges a US$25 one-time registration fee.
New personal Google Play accounts must run a closed test with at least 12 testers opted in for 14 days before applying for production access. Plan the calendar time, not just the money; our Google Play publishing checklist covers the steps.
If you sell digital goods inside the app, the stores take a service fee. Google Play's fee page lists rates between 10% and 30% depending on market, revenue level and transaction type.

Hosting and services

Free tiers have conditions. Vercel's Hobby plan is for personal, non-commercial use; Pro is listed at $20 per month.
Supabase's free plan pauses projects after a week of inactivity; Pro starts at $25 per month.
Add a domain, transactional email, error monitoring and backups. Individually small, together a fixed monthly line.

Maintenance and iteration

Dependencies, operating systems and store policies change after launch, and your first users will ask for changes. CB Insights' 2026 analysis of 431 shut-down VC-backed companies found that 70% ran out of capital and 43% cited poor product-market fit. Spending the whole budget on version one leaves nothing for the changes that would have found the fit. Our rule of thumb, not a statistic: keep a meaningful share of the budget, a third or more, for the weeks after launch.

Fixed price, hourly or monthly?

A fixed price works when the scope is small and well defined. It pushes risk onto the developer, who prices that risk in. Hourly and monthly retainer models suit products where the scope will change after users react, which is most MVPs. The trade-offs are covered in fixed price vs time and materials vs retainer.

Frequently asked questions

Can I build an MVP for $5,000?

Yes, if the scope is a single flow on one platform, or if part of it is built with no-code tools. At the illustrative rates above, $5,000 buys roughly 40 to 140 hours, so the scope has to fit.

How long does it take to build an MVP?

Divide the hours by the team's weekly capacity. One full-time developer at 160–240 hours delivers Scope A in about four to six weeks; mobile apps add store review and, on Google Play, the 14-day closed test.

Why do MVP quotes for the same idea differ so much?

Different assumptions about scope and different rates. Ask every vendor for an hour estimate per feature, then compare like for like.

What does an MVP cost to run each month?

For a small web MVP, often tens of dollars for hosting, database, email and monitoring, rising with usage. Add the Apple fee each year if you publish on iOS.

Sources

Software Developers, Quality Assurance Analysts, and Testers: Occupational Outlook Handbook, U.S. Bureau of Labor Statistics, May 2025
Minimum Viable Product (MVP), Agile Alliance, accessed October 2026
Top reasons startups fail, CB Insights, March 2026
Apple Developer Program enrollment, Apple, accessed October 2026
How to use Play Console: registration fee, Google Play Console Help, accessed October 2026
App testing requirements for new personal developer accounts, Google Play Console Help, accessed October 2026
Service fees, Google Play Console Help, accessed October 2026
Vercel pricing, Vercel, accessed October 2026
Supabase pricing, Supabase, accessed October 2026

Fixed price vs time and materials vs retainer: which software contract should you choose?

Adil Soukaini | Full-Stack Developer — Mon, 02 Nov 2026 09:00:05 +0000

Originally published on shipfastdev.com.

Choose fixed price when you can write the scope down completely and it will not change; choose time and materials when the work is uncertain and you can follow it closely, always with a spending cap; choose a retainer when the product needs steady work every month and priorities shift as you learn. Each model moves risk to a different party: fixed price moves cost risk to the provider and change risk to you, time and materials moves cost risk to you, and a retainer fixes spend while leaving scope flexible.

Fixed price: the provider carries the cost risk

US federal procurement rules give a precise definition: a firm-fixed-price contract "provides for a price that is not subject to any adjustment on the basis of the contractor's cost experience". If the work takes twice as long as estimated, the provider absorbs it. That is attractive, and it has consequences:

The estimate includes a risk margin. A provider who carries the risk prices it in. On well-understood work the margin is small; on vague work it is large or the provider loses money.
Scope becomes a negotiation. Anything not written in the specification is a change request, with its own quote and delay. In product work, where you learn from users every week, that friction adds up.
Quality is the hidden variable. When the budget runs short, the easiest things to cut are tests, documentation and edge cases. Protect them with written acceptance criteria.

Good fit: a marketing site from an approved design, a defined integration with a documented API, a migration with a clear before and after, a discovery or prototyping phase with a fixed length.

Time and materials: you carry the cost risk

Under the same rules, a time-and-materials contract pays for "direct labor hours at specified fixed hourly rates", and may be used only when it is not possible at the outset to estimate the extent or duration of the work with confidence. Two safeguards are mandatory there, and they are good practice for any startup:

A ceiling price that the provider exceeds at its own risk. For you: a monthly or per-feature cap that requires your approval to exceed.
Active oversight, because time-based pay gives no built-in incentive to control cost. For you: weekly timesheets tied to tasks, and regular releases you can check.

Time and materials is honest about uncertainty: you pay for the work actually done, and you can change direction at any time. The risk is drift: without priorities and caps, hours expand.

Good fit: an MVP whose scope will move, debugging or performance work on an unfamiliar codebase, research spikes, extending a team with in-house leadership.

Retainer: fixed spend, flexible scope

A retainer pays a fixed monthly amount for an agreed capacity and set of responsibilities: for example a number of development hours, code reviews, deployments and hosting care. You decide each month what that capacity works on.

Budget is predictable, like fixed price.
Scope is flexible, like time and materials: you reprioritise without a change request.
Continuity is built in: the same people keep context, which supports small, frequent releases (see weekly releases with a remote developer).

The risks are paying for idle capacity if you have no backlog, and disagreement about what "included" means. Write down the hours, what happens to unused hours, response times, what counts as out of scope and the notice period.

Good fit: a live product that needs regular features and fixes, post-launch iteration on an MVP, a small company without in-house developers.

How each model handles a change

Imagine that two weeks into the work, user feedback shows the onboarding flow should be rebuilt.

Fixed price: the provider writes a change request with a new price and date; you approve, negotiate or drop the change. The original deadline may move.
Time and materials: you reprioritise; the hours go to the new flow. Check the cap: if the change pushes you over it, decide what to cut.
Retainer: you move the onboarding rebuild to the top of next month's priorities; something else waits. Spend does not change.

The Agile Manifesto put this tension into one line in 2001: "customer collaboration over contract negotiation". A contract cannot remove uncertainty; it can only decide who pays for it and how quickly you can react.

Hybrids that work

Fixed-price discovery, then retainer or time and materials. Pay a fixed amount for a short scoping phase (specification, design, estimate), then build with a flexible model. See how to scope an MVP.
Fixed price per iteration. Agree a fixed price for each two- to four-week cycle with a short list of goals, and re-plan between cycles.
Time and materials with a cap per feature. Flexible, but every feature has a budget that triggers a conversation when 80% is used.

A note for France: régie and staff lending

In France, time-based work is often called régie. French labour law prohibits any for-profit operation whose sole purpose is lending staff (outside regulated temporary work), so a régie contract must remain a service: the provider brings its own expertise and keeps authority over its people. With an individual freelancer, a client who sets hours, gives detailed orders and integrates the person like an employee risks requalification as employment. Define deliverables and leave the provider in charge of how the work is done.

How to choose

Can you write the scope completely today? Yes: fixed price is an option. No: time and materials or a retainer.
Is the work a one-off or ongoing? One-off: fixed price or capped time and materials. Ongoing: retainer.
Who will follow the work weekly? If nobody can, avoid uncapped time and materials.
How will you judge progress? Whatever the model, look at delivered results. DORA's delivery metrics, such as deployment frequency and change lead time, work for all three.

For budget figures behind each model, see how much an MVP costs and what a software developer costs; for the provider side, freelancer vs agency vs dev retainer.

Frequently asked questions

What is the difference between fixed price and time and materials?

Fixed price sets the total price in advance, so the provider carries the cost risk and changes need a new quote. Time and materials pays for hours actually worked at agreed rates, so you carry the cost risk but can change direction freely.

Is fixed price good for an MVP?

Only if the scope is truly settled. Most MVPs change as users respond, and every change becomes a change request. A fixed-price discovery phase followed by a flexible model usually works better.

What is a development retainer contract?

A monthly contract for a fixed amount of development capacity and agreed responsibilities. You set priorities each month; spend stays the same.

How do I control costs in a time and materials contract?

Set a cap per month or per feature that requires your approval to exceed, ask for weekly time reports linked to tasks, and insist on regular releases you can check.

Sources

FAR 16.202-1 Firm-fixed-price contracts, Federal Acquisition Regulation (Acquisition.gov), n.d.
FAR 16.601 Time-and-materials contracts, Federal Acquisition Regulation (Acquisition.gov), n.d.
Manifesto for Agile Software Development, agilemanifesto.org, 2001
Article L8241-1 du Code du travail, Code du travail numérique (Ministère du Travail), n.d.
Indépendance juridique : risque de requalification du contrat de mission en contrat de travail, Bpifrance Création, 2026-06
DORA's software delivery performance metrics, DORA, 2026-01

How much does it cost to hire a software developer in 2026?

Adil Soukaini | Full-Stack Developer — Sat, 31 Oct 2026 09:00:05 +0000

Originally published on shipfastdev.com.

A full-time software developer in the United States costs roughly $190,000–$200,000 a year once employer costs are added to the median salary; in France, a median full-stack developer costs around $86,000 with social contributions. Freelancers in German-speaking Europe bill about €91 an hour for software and web development. The right number for you depends less on the headline rate than on how many hours of real product work you need each month.

Below are the figures, where they come from, and the assumptions you need to adjust before you use them in a budget.

Salary benchmarks by region

Two data sets are useful here. The US government's figure is the most robust; the developer survey gives a comparable view across countries.

United States (official statistics): the median annual wage for software developers was $135,980 in May 2025, or $64.44 an hour, according to the Bureau of Labor Statistics. Half earned more, half less.
Across countries (self-reported survey): the 2025 Stack Overflow Developer Survey reports these median yearly salaries for full-stack developers, converted to US dollars: United States $138,000, United Kingdom $85,428.50, Germany $75,410, France $58,007, India $13,949.
Specialisation matters: in the same survey, back-end developers in France report a median of $71,929 and mobile developers $63,228; in the US, back-end developers report $175,000.

Keep two caveats in mind. Survey salaries are self-reported and converted to dollars, so exchange rates move them. And a median says nothing about the person you will actually hire: a senior engineer who can own a product end to end usually sits well above it.

What an employee really costs: salary plus employer costs

Salary is not the cost of an employee. Employers also pay social contributions, insurance, paid leave and pensions.

In US private industry, wages and salaries made up 70.0% of total compensation in June 2026 ($32.82 of $46.89 per hour); benefits made up the other 30.0%.
In the EU, non-wage costs were 24.8% of total labour costs in 2025 (25.6% in the euro area). France had the highest share in the EU, at 32.3%.

Applying those ratios gives a rough annual cost per employee. These are whole-economy averages, so treat the results as an order of magnitude, not a quote from your accountant.

US median software developer: $135,980 ÷ 0.70 ≈ $194,000 a year, or about $16,200 a month.
French median full-stack developer: $58,007 ÷ (1 − 0.323) ≈ $85,700 a year, or about $7,100 a month.

Then add the costs that never appear in labour statistics: recruiting (job ads, agency fees or your own time), a laptop and software licences, onboarding time before the person is productive, and management time. If nobody on your team can review code or set technical direction, you also need to budget for that (see fractional CTO vs development partner).

What a freelancer costs

Freelance rates look high next to salaries because the freelancer covers their own taxes, equipment, unpaid gaps between projects and holidays. The largest recurring survey of freelancers in German-speaking Europe, freelancermap's Freelancer-Kompass 2026, found:

an average hourly rate of €91 for software and web development (€100 for IT infrastructure);
an average of €103 an hour across all fields, practically flat versus €104 the year before;
average monthly project revenue down about 17%, to €6,653, and 49% of freelancers reporting a worse order situation than the previous year.

The last two points matter to buyers: in 2026 good freelancers in that market have more availability than they did, so you have room to negotiate scope and commitment, not just price.

To compare with a salary, multiply the rate by the hours you actually need. At €91 an hour, a freelancer working 40 hours a month costs about €3,640; at 140 billable hours a month (close to full time), about €12,740. A full-time freelancer is therefore often more expensive than an employee in the same country, while a part-time one is usually much cheaper than any hire.

Agency and monthly retainer

Agencies price by project or by day and add project management, design and quality assurance on top of developer time. A monthly development retainer buys a fixed block of capacity from one developer or a small team for a flat fee. The trade-offs between these models (who carries the risk, how changes are handled, what happens if someone leaves) are covered in freelancer vs agency vs dev retainer and fixed price vs time and materials vs retainer.

A worked comparison

Suppose you need someone to ship and maintain a web product, and you estimate 60 hours of development a month for the next year. Using the figures above:

US employee: about $194,000 a year in total employment cost, for full-time capacity. You pay for full-time capacity even if you need 60 hours.
French employee: about $85,700 a year, same logic.
DACH freelancer at €91/hour: 60 × €91 × 12 ≈ €65,500 a year, with no recruiting cost but less continuity if they take another client.
Retainer: a flat monthly fee for agreed capacity; compare the fee with the hours and responsibilities included (reviews, deployments, hosting, support).

With these numbers the logic is clear: below roughly half-time need, buying capacity (freelancer or retainer) is cheaper than hiring; at full-time need for years, a hire usually wins on cost and gains knowledge that stays in the company.

How to estimate your own number

Start from the work, not the role. List what must ship in the next three to six months. If you do not have that list yet, start with how to scope an MVP and how much an MVP costs.
Convert to hours per month, then add 20–30% for meetings, reviews, bugs and deployments. This is a planning assumption, not a statistic; adjust it to your experience.
Price each model with your local salary data and the employer-cost ratio for your country.
Add the hidden items: recruiting, equipment, management time, and the cost of a bad fit (weeks of lost progress).
Check location options. Working with a developer in a nearby time zone can lower cost without losing working hours; see nearshore software development in Morocco.

Frequently asked questions

How much does it cost to hire a software developer per month?

In the US, a median developer costs about $16,000 a month including employer costs (BLS May 2025 median salary, 70% wage share). In France, a median full-stack developer costs about $7,100 a month including employer contributions. A part-time freelancer or retainer can cost a fraction of that because you only pay for the hours you need.

Is it cheaper to hire a freelancer or an employee?

For part-time or uncertain needs, a freelancer is usually cheaper because you pay only for hours worked and nothing between projects. For full-time work over several years, an employee usually costs less per hour and the knowledge stays in your company.

What is the average hourly rate of a freelance developer?

In Germany, Austria and Switzerland, freelancermap's 2026 survey puts software and web development at an average of €91 an hour. Rates vary widely by country, seniority and specialisation, so use local data where you hire.

What costs are on top of a developer's salary?

Employer social contributions and benefits (30.0% of compensation in US private industry; 32.3% non-wage costs in France), plus recruiting, equipment, software licences, onboarding time and management time.

Sources

Software Developers, Quality Assurance Analysts, and Testers (Occupational Outlook Handbook), U.S. Bureau of Labor Statistics, 2026-08
Employer Costs for Employee Compensation – June 2026, U.S. Bureau of Labor Statistics, 2026-09
2025 Developer Survey – Work (salary by developer type and country), Stack Overflow, 2025-07
Wages and labour costs (Statistics Explained), Eurostat, 2026-03
Freelancer-Einkommen: Projektumsatz sinkt um 17 % (Freelancer-Kompass 2026), freelancermap, 2026-04

Laravel vs Node.js for a startup backend: how to choose

Adil Soukaini | Full-Stack Developer — Fri, 30 Oct 2026 09:00:24 +0000

Originally published on shipfastdev.com.

For most startup backends, both Laravel and Node.js will do the job; the better choice depends on your product and your team. Laravel gets a typical SaaS or marketplace backend (accounts, admin, payments, emails, background jobs) built fastest because those pieces ship with the framework. Node.js, usually with NestJS or Express, fits best when your team writes TypeScript everywhere, when the product is heavy on real-time connections, or when you want the largest hiring pool.

Here is how they compare on the four things a founder should care about: ecosystem, hiring, speed of building and hosting.

First, what you are comparing

Laravel is a PHP web framework. Its documentation lists "thorough dependency injection, an expressive database abstraction layer, queues and scheduled jobs, unit and integration testing" among its built-in features, and it can serve either full pages or an API for a separate frontend or mobile app.
Node.js is a runtime, not a framework. Its own site describes it as "an asynchronous event-driven JavaScript runtime" built for scalable network applications.
Express is a minimal web framework on top of Node.js: routing and middleware, and you choose the rest.
NestJS is a structured framework for Node.js, written in TypeScript. Its docs say it uses Express by default, optionally Fastify, and that its architecture is "heavily inspired by Angular".

So the fair comparisons are Laravel vs NestJS (both opinionated, batteries-included) and Laravel vs Express (opinionated vs minimal).

Ecosystem: included vs assembled

Laravel's advantage is that the common parts of a business application are first-party and designed to work together. Authentication scaffolding comes from its starter kits, API tokens from Sanctum, background work from queues, and the official package list includes billing (Cashier), search (Scout), queue monitoring (Horizon) and real-time broadcasting. One set of docs, one upgrade cycle.

In Node.js, the npm ecosystem is enormous, but you assemble the stack: an ORM, a validation library, a queue, an auth solution. NestJS reduces the assembly by giving you modules, dependency injection and conventions. The NestJS docs are explicit about why it exists: many Node.js libraries exist, but "none of them effectively solves the main problem of architecture".

For a founder, the practical question is: how many decisions does your developer have to make before building your first feature? With Laravel, fewer. With Express, many. NestJS sits in between.

Hiring pool: what the survey data says

The 2025 Stack Overflow Developer Survey (23,678 respondents to the web frameworks question) reports these usage shares among all respondents:

Node.js 48.7%, Express 19.9%, NestJS 6.7%, Laravel 8.9%.
For languages: JavaScript 66%, TypeScript 43.6%, PHP 18.9%.

In the 2024 survey, the same frameworks stood at Node.js 40.8%, Express 17.8%, NestJS 5.8% and Laravel 7.9%. The samples differ each year, so treat this as direction rather than growth rates, but neither side is shrinking.

Two readings matter for hiring:

JavaScript/TypeScript developers are the larger pool. If your frontend is React or React Native, one language across the stack lets the same people work on both sides.
Framework-specific pools are closer than the language numbers suggest. NestJS (6.7%) and Laravel (8.9%) are in the same range. Hiring "a Node.js developer" does not mean hiring someone who knows how to structure a large backend.

PHP also has a very large installed base: W3Techs reports that PHP is used by 69.8% of websites whose server-side language it knows (October 2026). That is mostly existing sites, including WordPress, but it means PHP skills are common among agencies and freelancers. For more on today's hiring market, see hiring developers in 2026.

Speed of building

For a CRUD-heavy product (users, listings, bookings, invoices, an admin area) Laravel is usually quicker to a working first version, because the conventions answer most structural questions. Official starter kits provide the authentication screens and backend logic, and a new project uses SQLite by default, so you can start without a database server.

Node.js catches up, or wins, when:

the frontend and backend share TypeScript types, so API changes are checked at compile time on both sides;
the product keeps many connections open (chat, live dashboards, multiplayer features), which suits Node.js's non-blocking design: the Node.js site notes that "many connections can be handled concurrently";
you are building small services or serverless functions rather than one main application.

Node.js is weaker for CPU-heavy work in the request path; its documentation points to child processes and the cluster module to use multiple cores. Laravel pushes heavy work to queues. In both cases, long tasks belong in background jobs.

Hosting and running costs

Both run anywhere containers run. Laravel has its own managed options (Laravel Cloud, Forge, Vapor), and it runs well on container platforms; we describe one setup in deploying Laravel on Google Cloud Run. Node.js has the broadest choice of serverless and edge platforms, which helps if your frontend is Next.js.

At MVP scale, the hosting bill rarely decides the choice. The database, queues, search and file storage cost the same whatever language talks to them.

From our work

ShipFastDev builds with both Laravel and NestJS. The Driveway Morocco platform is a single Laravel application that serves the React web interface through Inertia and, since the mobile app was added, a JSON API with Sanctum token authentication for the Expo app. Search runs on Laravel Scout with Meilisearch (described in Laravel search with a Meilisearch fallback). One backend serves two clients, which kept the mobile app from needing its own server.

Decision checklist

Choose Laravel if:

your product is a classic web application or marketplace with an admin side;
you want auth, queues, emails, scheduled jobs and testing set up the same way on day one;
your developer or partner already knows PHP well.

Choose Node.js with NestJS if:

your team writes TypeScript across web, mobile and backend;
real-time features are central to the product;
you expect to hire several backend developers and want the largest pool.

Choose plain Express if the backend is small (a few endpoints, webhooks, a proxy to other services) and you don't need a framework's structure.

Whatever you choose, the bigger risk is an unstructured codebase, not the language; see technical debt explained for founders.

Frequently asked questions

Is Laravel still a good choice in 2026?

Yes. Laravel's share in the Stack Overflow survey went from 7.9% (2024) to 8.9% (2025), and the current documentation covers Laravel 13.

Is Node.js faster than Laravel?

For many concurrent, I/O-bound connections Node.js's event-driven model is a good fit. For a typical CRUD API the database and caching usually matter more than the language. Measure with your own workload before deciding on speed alone.

Laravel or NestJS for a mobile app backend?

Both work: each can expose a JSON API with token authentication. Pick NestJS if your mobile team writes TypeScript and wants shared types; pick Laravel if you also need a web admin and want it in the same app.

Can I switch from Laravel to Node.js later?

Yes, but it is a rewrite. A more common path is to keep the main backend and add a separate Node.js service for the part that needs it, such as real-time features.

Sources

2025 Stack Overflow Developer Survey: Technology, Stack Overflow, July 2025
2024 Stack Overflow Developer Survey: Technology, Stack Overflow, July 2024
Laravel 13.x documentation: Installation, Laravel, accessed October 2026
NestJS documentation: Introduction, NestJS, accessed October 2026
About Node.js, OpenJS Foundation / Node.js, accessed October 2026
Usage statistics of PHP for websites, W3Techs, October 2026

Hiring Junior Developers in the AI Era: What the Data Shows

Adil Soukaini | Full-Stack Developer — Wed, 28 Oct 2026 09:00:03 +0000

Originally published on shipfastdev.com.

Hiring of junior developers has fallen further than any other part of the software job market since 2022. Payroll data shows employment of US software developers aged 22 to 25 down nearly 20% from its late-2022 peak by September 2025, and new graduates now make up a small share of hires at both large tech companies and startups. Researchers disagree on how much of this is AI and how much is interest rates, but for a small team the practical question is the same: a junior hire works only if someone senior has time to review their work.

What the data shows

Employment of young developers is down. In the Stanford Digital Economy Lab's payroll study (ADP data), employment for software developers aged 22 to 25 had declined nearly 20% from its late-2022 peak by September 2025, while older age groups kept growing.
The gap keeps widening. In the August 2026 update, employment of 22–25-year-olds in highly AI-exposed occupations stands about 19% below where it would be had it kept pace with less-exposed peers, up from a 15% gap in July 2025. The adjustment happens "primarily through reduced hiring of young workers rather than increased separations."
New graduates are a small share of hires.SignalFire's 2025 report found new grads made up just 7% of hires at the 15 largest tech companies, down 25% from 2023 and over 50% from 2019. At VC-backed startups, they were under 6% of hires, down 11% from 2023 and over 30% from 2019.
The rebound is senior. US software development postings have grown almost 15% since early 2025, but 71% of the increase between May 2025 and May 2026 came from senior roles (Indeed Hiring Lab).
Graduates are taking other paths. According to LinkedIn's Economic Graph, 55% of computer science graduates started in non-software-engineering jobs in 2023 and 2024, against 49% in 2016, and entry-level software engineering hiring did not rebound at the end of 2025.

Is AI the cause? Two readings of the same trend

The Stanford authors argue their results are consistent with generative AI affecting entry-level work. Declines are concentrated in occupations where AI tends to automate tasks rather than augment workers. In a February 2026 note, they also tested the interest-rate explanation and found that "more AI-exposed jobs are actually less exposed to interest rates on average." With stricter controls, they find the decline is significant only after 2024, and they acknowledge that the fall in young developer employment has "various factors," not AI alone.

LinkedIn's economists read their own data differently. They find that software engineering hiring, junior and overall, has tracked the broader tech sector and national hiring, and that changes in real interest rates explain most of the variation over the past decade. They call the lack of an entry-level rebound "concerning for job seekers" but say it is not enough to blame AI.

Both camps agree on the fact that matters for you: the entry level is weak, and the recovery so far favours experienced people. For the wider market picture, see how AI is changing the developer job market.

The paradox: juniors gain the most from AI

The same tools that may be reducing junior hiring help juniors the most. In randomised field experiments with 4,867 developers at Microsoft, Accenture and a Fortune 100 company, an AI coding assistant increased completed tasks by 26.08% on average, and less experienced developers both adopted it more and gained more.

There is a catch. In a user study published at the ACM CCS 2023 security conference, participants with an AI assistant wrote significantly less secure code than those without, and were more likely to believe their code was secure. Participants who trusted the AI less and engaged more with their prompts produced fewer vulnerabilities. A junior with AI can produce a lot of plausible code quickly; without review, that is a risk, not a gain. Our checklist on AI-generated code security lists what to check.

Should your startup hire a junior developer?

It can work if

You already have a senior developer or technical lead who can review every change and has scheduled time for it.
The product's architecture is settled, and the backlog contains well-defined tasks: UI components, tests, internal tools, small integrations.
You have automated tests and continuous integration, so mistakes show up before production.
You can wait a few months for the hire to become fully productive.

Think twice if

You are pre-MVP with no technical lead. A junior should not be the person deciding architecture, authentication or data models.
Your product handles payments, health data or other sensitive information and no one can review security.
You need speed now. The research on AI coding assistant productivity shows gains depend on review and testing, which a junior alone cannot supply.

If you lack senior capacity, you can rent it: a fractional CTO or development partner can provide the review and direction that make a junior productive.

How to make a junior hire work with AI tools

Make code review non-negotiable. Every pull request gets a senior review before merge.
Ask juniors to explain AI-generated code. If they cannot explain a block line by line in review, it does not get merged. This keeps learning happening.
Route sensitive work to seniors. Authentication, payments, permissions and database migrations stay with experienced people until the junior has shown they handle them well.
Give them tests to write. Writing tests teaches the codebase and strengthens the safety net that AI-heavy teams need.
Track progress. Watch the number of review rounds per pull request; it should fall over the first months.
Document onboarding. A written setup guide and coding conventions help juniors and AI tools alike. See our guide to onboarding a remote developer.

The long-term cost of skipping juniors

Every senior developer was once a junior. If companies stop hiring at the entry level, the pool of experienced people who can review AI-generated code will shrink over time. For a single startup that is not a reason to hire someone you cannot support, but it is a reason not to dismiss junior candidates outright once you have the review capacity in place.

Frequently asked questions

Is it harder for junior developers to get hired in 2026?

Yes. Employment of US developers aged 22 to 25 fell nearly 20% from late 2022 to September 2025, and most of the 2025–2026 recovery in postings has been for senior roles.

Is AI replacing junior developers?

Partly, according to Stanford's payroll research, which links the decline to AI-exposed occupations. LinkedIn's analysis points mainly to interest rates and the economic cycle. The cause is debated; the weak entry-level market is not.

Should a startup hire a junior developer?

Only if a senior person can review their work regularly and the tasks are well defined. Without that, a junior with AI tools can produce code faster than anyone can check it.

How should junior developers use AI tools safely?

Use them, but treat output as a draft: understand every line, write tests, and get a senior review. Research shows AI users can write less secure code while feeling more confident about it.

Sources

Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence (working paper, November 2025 version), Stanford Digital Economy Lab, 2025-11
Canaries in the Coal Mine: August 2026 update, Stanford Digital Economy Lab, 2026-08
Canaries, Interest Rates, and Timing: More on Recent Drivers of Employment Changes for Young Workers, Stanford Digital Economy Lab, 2026-02
SignalFire State of Talent Report 2025, SignalFire, 2025-05
U.S. Software Engineer Talent Landscape, LinkedIn Economic Graph, 2026-02
AI and Job Postings: From Destruction to Creation?, Indeed Hiring Lab, 2026-07
The Effects of Generative AI on High-Skilled Work: Evidence from Three Field Experiments with Software Developers, Microsoft Research (Cui, Demirer, Jaffe, Musolff, Peng, Salz), 2025-06
Do Users Write More Insecure Code with AI Assistants? (ACM CCS 2023), Perry, Srivastava, Kumar, Boneh (arXiv), 2023-12

How AI is changing the software developer job market

Adil Soukaini | Full-Stack Developer — Tue, 27 Oct 2026 09:00:04 +0000

Originally published on shipfastdev.com.

AI has not wiped out software developer jobs, but it is changing who gets hired. In the US, software development job postings are still 27.5% below their February 2020 level, yet they have grown almost 15% since early 2025, and most of that growth is in senior and AI-related roles. The clearest losses are at the entry level, among developers aged 22 to 25.

This article pulls together the most recent official and research data (up to mid-2026) on employment, job postings and skills, then translates it into what it means if you are a founder about to hire.

Employment: still growing, but not evenly

The US Bureau of Labor Statistics counted 1,717,800 software developer jobs in 2025 and projects 10% growth for the occupation between 2025 and 2035, about 174,700 additional jobs. The median annual pay for software developers was $135,980 in May 2025. The BLS explicitly links the demand to AI: it expects strong demand because of "the continued expansion of software development for artificial intelligence (AI), Internet of Things (IoT), robotics, and other automation applications."

The picture is different for the narrower role of "computer programmer". The BLS projects a 7% decline in that occupation over the same decade (110,800 jobs in 2025), pointing to automation, AI handling repetitive coding tasks and higher-level work moving to software developers.

In Europe, the trend is still upward. Eurostat reports more than 10 million ICT specialists employed in the EU in 2025, 5.0% of total employment, up 59.4% between 2015 and 2025, against 9.8% growth in total employment.

So the headline is not "fewer developers". It is a shift away from roles that mostly turn specifications into code, and toward roles that design, integrate and own systems.

Job postings: a slow recovery led by senior and AI roles

Job postings react faster than employment statistics. According to Indeed Hiring Lab (July 2026):

US software development postings remain 27.5% below February 2020 levels.
They have grown by almost 15% since the launch of Claude Code in late February 2025, while overall postings fell 7% over the same period.
71% of the increase between May 2025 and May 2026 came from senior roles, and 37% from jobs with AI in their title.
The share of postings that are software development jobs has been rising in most large developed economies, with the exception of Germany and France.

Earlier in 2026, Indeed found that software development postings mentioned AI 20% or more of the time, and that tech postings mentioning AI were about 45% above their February 2020 level while total tech postings were 34% below it.

Who is losing ground: early-career developers

The strongest evidence of an AI effect concerns young workers. Stanford researchers Erik Brynjolfsson, Bharat Chandar and Ruyu Chen use ADP payroll data covering millions of US workers. In their August 2026 revision, employment of workers aged 22 to 25 in AI-exposed occupations stands 19% below where it would be had it kept pace with less-exposed peers. Experienced workers show no comparable gap, and the adjustment happens mainly through fewer hires of young people rather than layoffs. The authors also state that they find "no evidence of widespread, economy-wide job displacement."

Software developers are one of the two case studies in the paper. In the November 2025 version, employment for software developers aged 22 to 25 had declined nearly 20% from its late-2022 peak by September 2025, while older age groups kept growing.

Not everyone reads the data the same way. LinkedIn's Economic Graph team (February 2026) finds that software engineering hiring has broadly tracked the tech sector and the national economy, and that changes in real interest rates account for most of the variation in software engineering hiring over the past decade. They note that entry-level hiring did not rebound at the end of 2025 and call that "concerning", but say it is not enough to conclude AI is the cause. Our article on junior developer hiring in the AI era goes deeper into this debate.

Which roles and skills are growing, and which are shrinking

Growing

Senior engineers. They account for most of the 2025–2026 rebound in postings (Indeed).
AI engineers. LinkedIn reports that AI engineers now account for a share of software engineering hires 14 times higher than in 2019 and 10 times higher than in 2022. Machine learning engineers roughly doubled their share since 2019.
Cloud and data skills. The top skills among software engineers hired in 2021–2025 were Python, AWS, SQL, JavaScript and React.js, and the fastest-growing included AI, Tailwind CSS, Azure Databricks, Google BigQuery and Azure SQL (LinkedIn).
Software jobs outside tech companies. Professional services rose from 21.2% to 28.2% of software engineering postings between December 2023 and December 2025 (LinkedIn).

Shrinking or under pressure

Pure coding roles, as the BLS projection for computer programmers shows.
Entry-level positions, as shown by the Stanford data and the flat entry-level hiring LinkedIn observed at the end of 2025.
Profiles built only on basic web skills. LinkedIn notes that in 2016–2020 the top skills were JavaScript, CSS and HTML; hiring now leans toward Python, cloud and AI capabilities.

What it means if you are hiring

For a founder, these numbers translate into a few practical decisions:

Budget for experience. If most new demand is for senior people, that is where competition and salaries are. Our breakdown of the cost to hire a software developer shows how to compare options.
Hire for judgement, not typing speed. Coding assistants generate code quickly; the scarce skill is deciding what to build, reviewing it, testing it and keeping it secure. The research on AI coding assistant productivity shows gains are real but uneven, and depend on review and testing practices.
Don't plan to skip engineers entirely. AI app builders can get a prototype out, but security and maintenance still need someone accountable. See what vibe coding can and cannot do for an MVP.
Ask how candidates use AI. With a fifth or more of software postings mentioning AI, it is now normal to assess this skill. Our guide to hiring developers in 2026 covers how.
Look beyond a full-time hire. A small team may not need a permanent senior engineer on payroll. Compare a freelancer, an agency or a development retainer before deciding.

Frequently asked questions

Will AI replace software developers?

The data so far does not show it. The BLS still projects 10% growth in software developer jobs for 2025–2035, and the Stanford team finds no economy-wide displacement. What is shrinking is entry-level hiring and pure coding work.

Are software developer jobs growing in 2026?

Postings are recovering: Indeed measured almost 15% growth in US software development postings since early 2025, although they remain 27.5% below February 2020. Most of the new demand is for senior and AI-related roles.

Which developer skills are most in demand?

LinkedIn's 2026 data points to Python, cloud platforms (AWS, Azure, Google Cloud), SQL, React and AI-related skills. In practice, employers also look for the ability to review and test AI-generated code.

Is this a good time for a startup to hire developers?

Experienced developers are in demand, so expect competition for strong seniors. Junior candidates are easier to find, but they need mentoring and review capacity. Decide first which of those your team can actually support.

Sources

Software Developers, Quality Assurance Analysts, and Testers (Occupational Outlook Handbook), U.S. Bureau of Labor Statistics, 2026
Computer Programmers (Occupational Outlook Handbook), U.S. Bureau of Labor Statistics, 2026
AI and Job Postings: From Destruction to Creation?, Indeed Hiring Lab, 2026-07
January 2026 US Labor Market Update: Jobs Mentioning AI Are Growing Amid Broader Hiring Weakness, Indeed Hiring Lab, 2026-01
Canaries in the Coal Mine? Six Facts about the Recent Employment Effects of Artificial Intelligence (revised), Stanford Digital Economy Lab, 2026-08
Canaries in the Coal Mine? (working paper, November 2025 version), Stanford Digital Economy Lab, 2025-11
U.S. Software Engineer Talent Landscape, LinkedIn Economic Graph, 2026-02
ICT specialists in employment, Eurostat, 2026

OptiVision: a white-labeled Odoo ERP for opticians

Adil Soukaini | Full-Stack Developer — Mon, 26 Oct 2026 09:00:03 +0000

Originally published on shipfastdev.com.

OptiVision ERP is ShipFastDev's white-labeled Odoo 16 setup for opticians and eyewear shops: an eyewear catalogue with frame, lens and contact-lens specifications, a point of sale, stock management and sales reporting by eyewear category, all under the shop's own name and logo. It runs on Odoo Community with two custom modules. It is not public; a demo is available on a call.

What an optician can do

Keep an eyewear catalogue. Frames, prescription lenses, contact lenses, sunglasses, accessories and lens care, each product with an "Optician Details" tab next to Odoo's usual sales, purchase and inventory tabs.
Record frame specifications: material, style, colour, frame width, bridge width, temple length, and lens width and height.
Record lens and contact-lens specifications: lens type (single vision, bifocal, progressive), material, index and prescription ranges; coatings (UV protection, blue-light filter, anti-reflective, photochromic); base curve, diameter, water content and oxygen permeability for contact lenses; and prescription values (SPH, CYL, AXIS, ADD, prism).
Flag what a product needs: whether a prescription is required, whether it is a prescription lens, whether it needs in-house fitting, and its warranty.
Start with real brands. The sample data includes frame brands (Ray-Ban, Oakley, Gucci, Tom Ford, Persol), lens makers (Essilor, ZEISS, Hoya) and contact-lens brands (Acuvue, CooperVision, Bausch + Lomb).
Sell at the counter with Odoo's point of sale, products grouped as frames, lenses, contact lenses, sunglasses, lens care and accessories. Odoo documents that its Point of Sale works on any device with a web browser, even if you are temporarily offline.
See what sells. A sales analysis report shows revenue by eyewear category, for example prescription lenses against frames and sunglasses.
Scan barcodes for stock adjustments, picking and receiving, with a USB scanner or a phone camera.

What was built

Odoo 16 Community in Docker. Odoo and PostgreSQL run with Docker Compose, with a production Nginx configuration alongside. Stock and replenishment come from Odoo's standard Inventory app.
An optician module. A custom module adds the eyewear fields, a brand model, an API-key model, the optician views and sample data. Like any Odoo module, it declares its dependencies and data in a manifest, so it installs and upgrades on its own, with one documented command to upgrade it.
A white-label module. A second module removes Odoo's branding from the interface and gives the shop its own login page, colours, headers and footers, PDF report branding and email templates. A Branding settings page holds the brand name, tagline, support contact, colours and logos, and each company can set its own login logo, email header logo, PDF logo, favicon and footer text. Its latest version also hides the Enterprise upgrade prompts.
A REST API for other apps. Endpoints list products (filtered by type, brand or in-stock status), return product details with images, list brands, check stock by SKU and update stock levels. They are built as Odoo web controllers. API keys are managed in Inventory settings, one per app, each read-only or read-write, with usage tracking (last used, request count) and the option to regenerate or deactivate a key.
Community modules instead of Enterprise features. Modules from the Odoo Community Association (OCA) cover barcode scanning, barcode generation and multiple barcodes per product, SQL and visual BI reports, Excel and CSV exports, and approval workflows. For the till, OCA's point-of-sale modules add margin on POS orders, the discount amount on the cashier screen and ticket, order-line editing, customer comments, lot selection and a default customer.

How it is kept reliable

Rate limits. The production Nginx configuration allows 10 API requests per second (burst of 20) and 5 login attempts per minute (burst of 5).
Security headers and filtering. HSTS, X-Frame-Options, X-Content-Type-Options and a Content-Security-Policy, plus rules that block SQL-injection patterns, cross-site scripting attempts, vulnerability scanners and path traversal.
Caching. Static files are cached for 7 days and images for 1 day.
API access. Every endpoint except the health check requires an API key, and updating stock requires a key with write permission. The health check lets monitoring tools see whether the service is up.
A production checklist. The README lists what to do before go-live: change the master and database passwords, enable HTTPS, configure the firewall, schedule backups, review API-key permissions and turn on two-factor authentication for admins. Backup, restore and module-upgrade commands are documented.
Standard Odoo underneath. The changes live in separate modules rather than in Odoo's code, so the base system stays standard Odoo 16 Community.

Recent releases

The repository's four commits are all dated 25 January 2026:

The initial project: Docker setup, the optician and white-label modules, the OCA modules and the documentation.
Docker Compose exposes an additional Odoo port and includes a commented Nginx service for a local reverse proxy.
The white-label module moved to version 16.0.2, with a fuller debranding description and scripts and styles that hide Enterprise features and upgrade prompts.
Documentation on where to find the OCA barcode scanner, how to install the alternatives and which Enterprise features they replace.

When Odoo fits

For the wider question of whether an ERP like this suits your business, see Odoo ERP for small businesses, and No-code vs custom development for when configuration is enough and when custom modules are worth it. More projects are in the portfolio, including the Driveway Morocco case study.

Frequently asked questions

Is OptiVision a separate product from Odoo?

No. It is Odoo 16 Community with two custom modules (optician fields and white-label branding) and a set of OCA modules. Staff see the shop's brand instead of Odoo's in the back office, on the login page and in reports and emails.

Can it connect to an online shop or other apps?

Yes, through its REST API: products, brands, stock checks by SKU and stock updates, each app with its own key set to read-only or read-write.

Does it need Odoo Enterprise?

No. It runs on Odoo Community, and OCA modules provide the barcode scanning, reporting, exports and approval workflows that would otherwise come from Enterprise.

Can I see it?

OptiVision is not public. A demo is available on a call.

Sources

Point of Sale (Odoo 16.0 documentation), Odoo S.A., accessed October 2026
Inventory (Odoo 16.0 documentation), Odoo S.A., accessed October 2026
Module manifests (Odoo 16.0 developer documentation), Odoo S.A., accessed October 2026
Web controllers (Odoo 16.0 developer documentation), Odoo S.A., accessed October 2026
OCA/pos, branch 16.0, Odoo Community Association (GitHub), accessed October 2026
OCA/stock-logistics-barcode, Odoo Community Association (GitHub), accessed October 2026

Nearshore software development in Morocco: a practical guide for European companies

Adil Soukaini | Full-Stack Developer — Sat, 24 Oct 2026 09:00:04 +0000

Originally published on shipfastdev.com.

Morocco works well as a nearshore base for French and European companies: since 20 September 2026 it is on GMT all year, one hour behind Paris in winter and two in summer, so a normal working day overlaps almost entirely. French is widely read and written, English is improving, and the government's Digital Morocco 2030 plan targets 240,000 digital jobs. What makes it work in practice is how you set up the collaboration: overlap hours, written specs, ownership of your accounts and a proper data-transfer contract.

Time zone: what changed in 2026

For years Morocco stayed on GMT+1 and switched back to GMT during Ramadan. That ended in 2026. Decree 2.26.530, adopted on 25 June 2026 and published in the Official Bulletin on 29 June, repealed the 2018 GMT+1 decree and returned the country to GMT from Sunday 20 September 2026; clocks went back 60 minutes for the last time.

France still changes its clocks: summer time starts on the last Sunday of March and ends on the last Sunday of October, a schedule harmonised across the European Union since 1998. In practice:

From late October to late March: Morocco is one hour behind Paris. 9:00 in Casablanca is 10:00 in Paris.
From late March to late October: Morocco is two hours behind Paris. 9:00 in Casablanca is 11:00 in Paris.

With standard 9:00–18:00 days on both sides, that leaves roughly eight hours of shared time in winter and seven in summer: plenty for a daily check-in, live pairing and same-day fixes. Agree on the overlap window in writing and put both time zones in calendar invites around the two changeover weekends.

Languages

Morocco's 2024 census (RGPH 2024) measured which languages people can read and write. Among literate Moroccans aged 10 and over, 99.2% read and write Arabic, 57.7% French and 20.5% English; in urban areas the figures are 64.3% for French and 25.2% for English. For a French company, this means many developers can work, write tickets and document in French.

English is the language of code, libraries and documentation, and levels are rising. In the EF English Proficiency Index 2025, Morocco ranks 68th globally with a score of 492, against a global average of 488; respondents working in IT score 504, and Rabat (517) and Casablanca (503) are above the national average. In short: French is the safer default for meetings with French teams; check written and spoken English in the interview if your team works in English.

Talent pool and national strategy

Morocco's population was 36,828,330 on 1 September 2024, with 62.8% living in cities and 59.6% of people aged 15 and over using the internet. The digital strategy, Digital Morocco 2030, was presented in September 2024 with these targets, as reported at the launch:

240,000 direct jobs in the digital sector and a contribution of 100 billion dirhams to GDP by 2030;
100,000 people trained in digital skills each year, including 50,000 career changers;
digital exports rising from 17.9 billion dirhams in 2023 to 40 billion in 2030;
3,000 startups by 2030.

Public money has followed: according to the government portal, public investment in digital rose from 11 million dirhams in 2021 to more than 1.7 billion dirhams in 2024. The US Commerce Department's country guide also notes the other side: Morocco faces a shortage of skilled professionals in cybersecurity, data science and software development. Experienced developers are in demand, so expect to compete for them and to verify experience carefully.

Data protection: Morocco is not an "adequate" country

If the developer will access personal data from your EU users (a production database, analytics, customer emails), that is a transfer outside the EU under the GDPR. Morocco is not on the European Commission's list of countries with an adequacy decision, so you need another legal basis. For most small companies that means the Commission's standard contractual clauses (SCCs), signed with the provider, plus a short transfer impact assessment. Better still, limit access: give developers anonymised or seeded data and keep production access to the minimum (see onboarding a remote developer).

How to work well with a developer in Morocco

Fix a shared window. For example, 10:00–17:00 Paris time in winter (9:00–16:00 in Morocco). Hold the daily check-in inside it.
Choose the working language explicitly. French, English or both, for meetings and for written tickets. Don't assume.
Write things down. Short written specs with acceptance criteria beat long calls. They also survive time-zone gaps and handovers.
Keep ownership on your side. The repository, hosting, domain and analytics accounts belong to your company; the developer gets invited with the right role. See code ownership and IP when outsourcing.
Release small and often. A weekly release rhythm keeps both sides honest about progress (see weekly releases with a remote developer).
Share a calendar of public and religious holidays on both sides at the start of the year, so nobody plans a launch on a day off.
Agree on currency and contract. Invoices in euros or dollars, the applicable law, notice period and the IP clause. Ask your accountant about VAT treatment for services bought from outside the EU.

For a concrete example of a product built and run from Morocco, see the Driveway Morocco case study and the portfolio. To compare costs with hiring locally, read what a software developer costs.

Frequently asked questions

What is the time difference between Morocco and France?

Since 20 September 2026 Morocco is on GMT all year. It is one hour behind France from the last Sunday of October to the last Sunday of March, and two hours behind during French summer time.

Do Moroccan developers speak French?

Many do. In the 2024 census, 57.7% of literate Moroccans aged 10 and over could read and write French, and 64.3% in urban areas. Check the level you need during the interview.

Is it legal to give a developer in Morocco access to EU personal data?

Yes, with safeguards. Morocco has no EU adequacy decision, so use the European Commission's standard contractual clauses and give access only to the data the work requires.

Is Morocco a good nearshore destination for software development?

It offers time-zone overlap with Europe, French-speaking talent and an active national digital strategy. Experienced developers are in demand, so focus on verifying skills and setting up the collaboration well.

Sources

Maroc : le retour à l'heure GMT officiellement acté à partir du 20 septembre, Hespress FR, 2026-07
Changement d'heure : passage à l'heure d'été le 29 mars 2026, Service-Public.fr, 2026-03
Recensement Général de la Population et de l'Habitat 2024 – Principaux résultats, Haut-Commissariat au Plan (HCP), 2024-12
EF EPI 2025 fact sheet – Morocco, EF Education First, 2025
Digital Morocco 2030 : 100 milliards de dirhams et 240.000 emplois pour dynamiser l'économie numérique, Hespress FR, 2024-09
La stratégie Digital Morocco 2030 fait du numérique un moteur de compétitivité et d'inclusion sociale, Maroc.ma (portail national du Royaume du Maroc), 2026-06
Morocco – Country Commercial Guide: Digital Economy, International Trade Administration (U.S. Department of Commerce), 2025-07
Adequacy decisions, European Commission, 2026-02
Transférer des données hors de l'UE, CNIL, n.d.

Freelancer vs agency vs development retainer: which one fits your product?

Adil Soukaini | Full-Stack Developer — Tue, 20 Oct 2026 09:00:37 +0000

Originally published on shipfastdev.com.

Hire a freelancer for a well-defined task you can describe and check yourself; hire an agency for a fixed project with a deadline that needs several skills at once (design, front end, back end, QA); choose a monthly development retainer when your product needs steady, ongoing work from people who already know the code. Most problems with outsourcing come from using one model for a job that fits another.

What you are actually buying

Freelancer: one person's time, usually billed by the hour or day, sometimes per deliverable. Independent work is common in the profession: 13.9% of respondents to the 2025 Stack Overflow Developer Survey describe themselves as independent contractors, freelancers or self-employed.
Agency: a company that delivers a project with a team it assembles and manages. You buy an outcome and pay for coordination as well as code.
Development retainer: a fixed monthly fee for an agreed amount of capacity and responsibility (for example, a set number of hours, code reviews, deployments, hosting care) from the same developer or small team, month after month. You buy continuity.

How the three models compare

Cost structure

Freelancers bill for time, so you pay only for what you use; in German-speaking Europe the average rate for software and web development was €91 an hour in 2026. Agencies add project management and margin, and usually quote per project. A retainer is a flat monthly amount: predictable for budgeting, but you pay for the capacity even in a quiet month. For full numbers, see what it costs to hire a software developer.

Continuity and knowledge

A freelancer may move to another client when your project pauses, and the knowledge leaves with them. Agencies rotate staff between projects, so the person who built your feature may not be the one who fixes it. A retainer is designed for continuity: the same people keep context from month to month, which is what makes small, frequent releases possible (see weekly releases with a remote developer).

Breadth of skills

One freelancer brings one skill set. An agency can staff designers, several developers and testers in parallel. A retainer with a single developer sits in between: one accountable person, with the option of bringing in specialists for specific pieces.

Management load on you

With a freelancer, you are the project manager: you write the tasks, review the work and decide priorities. An agency takes most of that on, which is valuable if nobody on your side can do it, and costly if you could. A retainer works best when you set priorities and the developer owns the technical decisions and delivery.

Speed to start

Freelancers can often start within days. Agencies need a proposal, estimate and contract. Retainers usually start with a short onboarding period; a practical two-week plan is in onboarding a remote developer.

The risks of each model

Freelancer

Single point of failure. Illness, holidays or a better-paid contract stop your project. Keep the code in your own repository and insist on written handover notes.
Misclassification. If you treat a full-time freelancer like an employee, tax authorities may too. In the US, the IRS looks at behavioral control, financial control and the type of relationship. In the UK, medium and large clients have been responsible for deciding employment status under the off-payroll (IR35) rules since April 2021. In France, a client who directs the freelancer like an employee risks requalification into an employment contract, with back pay, contribution adjustments and possible penalties for concealed work.

Agency

Change requests. A quoted project is priced on a fixed scope; every change becomes a negotiation. See fixed price vs time and materials vs retainer.
Staffing you did not choose. Ask who will write the code, not just who runs the sales call.
Handover. When the project ends, the team moves on. Make sure you receive the repository, documentation and deployment access, and that the contract transfers the rights to the code (see code ownership and IP when outsourcing).

Retainer

Unused capacity. If you do not have a backlog, you pay for idle time. Keep a prioritised list of work ready.
Vague scope. "Development as needed" invites disagreement. Write down what is included (hours, response times, reviews, hosting, support) and what is not.
Dependency. The same continuity that helps can make you dependent. The safeguards are the same as with a freelancer: your repository, your hosting accounts, documentation and a notice period.

Which one fits your situation

A defined, short task (fix a payment bug, build one integration, migrate a WordPress theme): a freelancer, paid per task or for a capped number of hours.
A defined project with a hard deadline and several disciplines (a marketing site with a design system, a first version of an app for a launch date): an agency, if you can write the scope clearly.
A live product that needs regular releases, fixes and small features every month: a retainer.
An MVP whose scope will change as you learn: usually a retainer or time-based freelance work, because fixed-price quotes punish change. Start by scoping the MVP.
A team with in-house engineers that needs extra hands: a freelancer or retainer who works inside your process.

How to judge any of them after three months

Whatever the model, measure delivery, not hours. DORA, a long-running research programme on software delivery, defines five delivery metrics: change lead time, deployment frequency, failed deployment recovery time, change fail rate and deployment rework rate. You do not need a dashboard. Ask simple questions every month: how often did working changes reach production, how long did a typical change take from request to release, and how many releases needed an urgent fix?

Also check that you can answer yes to these: the code is in a repository your company owns, you can deploy without the provider, and there is enough documentation for someone else to take over.

Frequently asked questions

Is a freelancer cheaper than an agency?

Usually per hour, because an agency adds project management and margin. But if you have to manage the freelancer yourself, count your own time too. For a multi-skill project with a fixed deadline, an agency can be cheaper overall.

What is a development retainer?

A monthly agreement where you pay a fixed fee for a defined amount of development capacity and responsibilities from the same developer or team. It suits products that need ongoing releases, maintenance and small features rather than a one-off build.

Can a long-term freelancer be treated as an employee?

Yes, if the relationship looks like employment. US, UK and French authorities all look at control, integration into your organisation and economic dependence. Keep the freelancer independent in how they work, and get local advice for long engagements.

Should a startup outsource development?

Outsourcing makes sense when you need to ship before you can justify a full-time hire, or need skills you lack. Keep ownership of the code, the hosting accounts and the product decisions in-house whichever model you choose.

Sources

2025 Developer Survey – Work, Stack Overflow, 2025-07
Freelancer-Einkommen: Projektumsatz sinkt um 17 % (Freelancer-Kompass 2026), freelancermap, 2026-04
Independent contractor (self-employed) or employee?, Internal Revenue Service (IRS), 2026-05
Understanding off-payroll working (IR35), HM Revenue & Customs, GOV.UK, 2026-02
Indépendance juridique : risque de requalification du contrat de mission en contrat de travail, Bpifrance Création, 2026-06
DORA's software delivery performance metrics, DORA, 2026-01