Skip to content
Legacy Rescue

Your developer disappeared. Here is what to do first

A practical recovery order when the person who built your software stops replying: what to secure, what to prove you own, and what to rebuild.

4 min read
Your developer disappeared. Here is what to do first. An article by Athabasca Solutions.

It happens more often than anyone admits. The developer who built your system stops answering. Sometimes they moved on, sometimes the relationship soured, occasionally something happened to them.

What you are left with is software that runs, nobody who understands it, and a sinking feeling about what you actually own. Work through it in this order, because the sequence matters more than the speed.

First: establish what you control, not what you own

Ownership is a legal question. Control is a practical one, and control is what determines whether you are stuck this afternoon.

Go through these one at a time and record, for each, whether you can log in today:

  • The domain. Which registrar, whose account, whose card.
  • DNS. Often somewhere different from the registrar.
  • Hosting, and whatever the application actually runs on.
  • The code repository. GitHub, GitLab, a hard drive, or nowhere.
  • Email, if it shares the domain.
  • Third-party services the software calls: payment processing, mapping, SMS, anything with an API key.

The domain is the one to fix first, before anything else on this list. Losing the domain means losing the website and the email at once, and it is the item most often sitting in someone else’s personal account.

Second: stop the bleeding

Rotate what you can, carefully. Any credential you can change without breaking the running system, change. Any credential you cannot change without understanding the system, write down and come back to.

Be deliberate here. Revoking an API key that the software uses every night will take something down, and finding out at 2am does not help. Change the human logins now; leave the machine credentials until you know what uses them.

Get a backup you hold. Code, database, uploaded files, downloaded onto storage you control. If you can only do one thing today, do this one.

Do not let anything auto-renew on a card nobody watches. A lapsed hosting payment while you are working this out is an avoidable outage.

Third: find out what you legally own

Check the contract, if there is one. You are looking for who owns the intellectual property in the code. In the absence of a written assignment, the answer is frequently not what the client assumed, and it varies by jurisdiction and by whether the developer was a contractor or an employee.

This matters less than people fear in practice, because in most small-business cases the developer is unreachable rather than hostile. But know where you stand before you spend money on the assumption that the code is yours to modify. If real money is involved, this is a question for a lawyer rather than a developer.

Fourth: get an independent read

Now, and not before, find out what you actually have. That is a specific piece of work: somebody reads the code and the infrastructure and tells you in plain language what it does, what is dangerous, and what the options cost. It is covered properly in what a code audit actually tells you.

Two warnings about who you ask.

The first developer you speak to will very likely tell you it is a mess and should be rebuilt. Sometimes that is true. It is also the answer that generates the largest possible invoice, and it is the answer almost every developer gives about almost every codebase they did not write. Ask for the reasoning, ranked, with a cost against each option including “leave it as it is.”

The second is that a system running a real business is worth more than its code quality suggests. Ugly software that correctly handles fifteen years of edge cases is an asset. A clean rewrite that has never met a real customer is not, yet.

Fifth: make sure this cannot happen twice

Whatever you decide, end with:

  • Every account in the business’s name, with a second person having access.
  • The code in a repository you own, with the current version actually pushed to it.
  • A written page describing what runs where and who to call.
  • A supplier arrangement where you hold the accounts and they are added as users, never the reverse.

That last point is the whole lesson. The reason this became an emergency is not that somebody left. People leave. It is that leaving took the keys with them.

If you are in the middle of this and want someone to work through it with you, tell us what you can still log in to. That one answer usually determines the whole plan.

Related: taking over software nobody understands, inheriting a website nobody maintained, and our legacy rescue work.

Further reading

Sections covered in Your developer disappeared. Here is what to do first: First: establish what you control, not what you own, Second: stop the bleeding, Third: find out what you legally own, Fourth: get an independent read, Fifth: make sure this cannot happen twice
The shape of the argument, in order.

Get new articles by email

One email when something new goes up, roughly twice a month. Plain writing on what software costs and what is worth building. No sequences, no sales calls, and one click to leave.

We use it for the newsletter and nothing else. Unsubscribe any time.

Have something you need built?

Tell us what the problem is. You will get an honest read on whether it is worth building, what it would take, and roughly what it would cost. No pitch deck, no pressure.

Replies within one business day. Mon to Fri, 9am to 5pm MT.

Call Start a project