When a developer leaves — or an AI-assisted "vibe-coded" prototype suddenly has to go to production — someone inherits a codebase they didn't write. The instinct is to start fixing things. That's usually the expensive mistake. Before you change a single line, run this takeover check.
1. Do you actually control it?
Repo access is not control. Confirm you hold the production hosting account, the domain and DNS, the database, the DNS registrar, and the deploy pipeline — under accounts your company owns, not a personal login from the person who left. If any of these sit in someone else's account, getting control back is step zero. Everything else waits.
2. Can you build and run it from a clean machine?
Clone into a fresh environment and follow whatever docs exist. If you can't get a working local build in an afternoon, you have an onboarding problem before you have a code problem. Capture the exact steps as you go — that becomes the README that never existed.
3. Where do the secrets live?
API keys, tokens, and env vars hard-coded in the repo or living only in one person's laptop are a time bomb. Inventory every secret, rotate the ones that walked out the door, and move them into a real secret store.
4. What happens on deploy — and can you roll back?
Trace one change from commit to production. Is there CI? A staging step? A way to revert in 60 seconds when something breaks at 2am? A takeover without a rollback path is how a small fix becomes an outage.
5. What's the blast radius of the data?
Find the database, confirm backups actually run and restore, and check whether personal data is handled sanely. Vibe-coded apps love to log everything and secure nothing.
6. Which parts are load-bearing vs. decorative?
AI-generated code often includes plausible-looking functions that are never called and "working" features held together with copy-paste. Map the real request paths before you trust the file names.
7. Rescue, rebuild, or bring in a lead?
With the above answered, the decision is usually clear: small controllable surface → rescue in place; no control, no tests, unknown data → contain first, rebuild the core; strategically important but under-owned → bring in a fractional lead to stabilize before scaling. Don't let sunk cost pick for you.
Score your own situation (free, no signup)
I built the full version of this into a free browser self-check — it scores your takeover risk across these dimensions and points you to the right next move. Nothing to install, no email required:
If you're staring at an inherited or AI-built app right now, do the control check (point 1) first. Most "the code is a mess" emergencies are really "we don't own our own production" emergencies in disguise.
Top comments (0)