Service · Software Project Rescue & Takeover
Stalled software project?Take back control.
An unfinished app, an agency that stopped answering, a codebase nobody on your side can run. We take it over in an order that keeps you in control: access first, diagnosis second, fixes third.
Most rescue conversations start the same way: "We paid for a product, it is almost done, and now we are stuck." The team that built it is gone or slowing down, every change breaks something, and you are not sure what you actually own.
The first thing we do is not write code. It is to establish who holds every account, what runs where, and whether the product can be built from what you have. Then we write down what we found, what it means and what we would do first — and you decide the next step with a document in hand, not a sales pitch.
01 / Situations
Five ways a project ends up here
The code can be good, bad or unknown. What these situations share is that responsibility has to move, and nobody has written down what is being handed over.
02 / Fit
Who this is for, and who it is not for
A good fit when
- There is an existing product — in production or close to it — and a business reason to keep it alive.
- You can give us read-only access to the code and infrastructure, or arrange it with the previous team.
- You want a written assessment before committing to a longer engagement, and you are prepared to hear "rebuild" if that is the honest answer.
- Someone on your side can sign off on ownership transfers: cloud account, domain, app-store accounts, payment provider.
Not the right fit when
- You need a quote for "finishing the app" without anyone looking at the code. We do not price what we have not seen.
- The goal is a legal dispute with the previous vendor. We document what we find; we are not expert witnesses and this page is not legal advice.
- The product was built with AI tools and the question is specifically about AI-generated code quality — that has its own page.
- The system runs on a technology stack that is end-of-life and the question is modernization rather than responsibility — that also has its own page.
03 / Access audit
Step one: access and ownership, before any fix
A fix that depends on a password held by someone who has left is not a fix. The audit produces one table: every asset, its registered owner, who actually has access, and its status.
- 01
Inventory
Code repositories, environments and servers, databases and backups, domain and DNS, app-store accounts and signing keys, third-party services and API keys, secrets, work tools, contracts and licenses.
- 02
Registered owner versus actual access
For each row: whose name is the account in, and who holds the credentials. "Unknown" is acceptable at the start of the inventory and unacceptable at its end.
- 03
Transfer and rotate
Accounts registered to the previous team move into your organization. Passwords and keys are rotated at an agreed time with a rollback plan, so a service that stops after a rotation can be restored.
- 04
Clean build and backup restore
The product is built from the repository on a clean machine and compared with production; the latest backup is restored into a test environment. Gaps between what runs and what you hold are the first findings.
04 / Assessment deliverables
Step two: a written diagnosis you can act on
The assessment is a deliverable in its own right. If you decide to continue with another team, this is what stays with you.
05 / Stabilization
Step three: stabilize in priority order
Only after ownership is yours and the diagnosis is written does the code change. The order is set by the findings, not by what is easiest to show.
- A first, small, non-critical change goes all the way through: code, test, deploy to production. If the deployment path does not match the documented process, the process is fixed before the next change.
- Security and data integrity first: exposed secrets, missing authorization checks, backups that have never been restored.
- Stability second: the incidents users actually hit, with tests that stop them from coming back.
- Then the unfinished scope — specified in writing, estimated against the diagnosis, and shipped in sprints with a version you can open after each one.
- Documentation and a handover record are written as we go, so the product does not depend on us any more than it depended on the previous team.
06 / The decision
Keep, refactor or rebuild: how the decision is made
Four signals, read from the diagnosis. Upgrading is not always rebuilding: sometimes one component is replaced and the rest stays.
| Signal | Points to continuing on what exists | Points to a refactor or rebuild |
|---|---|---|
| Critical findings | Fixable locally without touching the structure | Stem from the structure itself and recur in every component |
| Dependencies | Maintained, or updatable incrementally | The core relies on technology that is no longer updated |
| Cost of change | A small change stays small once the new team knows the code | Every change touches many parts and requires retesting everything |
| Business needs | The product does what the business needs; improvements are missing | The business has changed and the product assumes a process that no longer exists |
07 / Scope
What a rescue includes, and what is a separate project
This boundary is what prevents surprises on the invoice. The table describes the typical division; the exact scope is written in your proposal.
| Type of work | Assessment | Rescue and stabilization | Separate project |
|---|---|---|---|
| Access and asset audit | Included — this is where it starts | Kept current throughout | — |
| Written diagnosis and recommendation | Included — the main deliverable | Updated as findings change | — |
| Ownership transfer and credential rotation | Planned | Included — before the first change | — |
| Security and stability fixes | Listed and ranked | Included — in the order set by the report | — |
| Finishing unfinished scope | Estimated | Included when specified in the proposal | Larger scope is priced and planned separately |
| New features | — | Not included — opened as a scope extension | Yes — priced and planned separately |
| Ongoing maintenance and incident response | — | Basic monitoring set up | A maintenance agreement with its own scope and response times |
| Architecture rewrite or technology replacement | Recommended or not, with reasons | Only if the report concludes there is no alternative | Yes — with its own migration plan |
What ongoing maintenance includes after a rescue, and how to budget for it, is covered in a separate guide.
What app maintenance includes and how to budget for it08 / Risks
Risks we name up front
09 / Why us
Why Onezero Labs
10 / Do it yourself
Start with the checklist, even before you talk to us
The same asset table, pre-acceptance checks and staged transition plan we use, as a guide and a template you can fill in for your own product.
The full guide explains each stage: what to receive, what to verify before accepting responsibility, how to plan a staged transition, and how you know the handover is complete.
Moving to a new development vendor: what to receive, verify and hand overFAQ
Frequently asked questions
Usually yes, if the assets are registered in your name — code, cloud accounts, domain and stores. If some are registered to the previous vendor, the takeover starts with ownership transfer, and sometimes that requires invoking the contract. That is why the first column of the asset table is always "whose name is it in".
We do not know until the assessment, and neither does anyone else. The recommendation is written against four signals — where the critical findings come from, the state of dependencies, the cost of a small change, and whether the product still matches the business. Continuing on what exists is our default; a rebuild is recommended only when the findings stem from the structure itself.
The assessment itself: a system map, ranked findings with severity and effort, the asset and access table, and the keep / refactor / rebuild recommendation with reasons. It is written so another team can act on it. There is no obligation to continue, and we tell you if we think a different partner fits better.
Not necessarily, but nobody can promise zero disruption before the audit — it depends on what the clean build and the backup restore uncover. What we can do: plan every stage so it can be rolled back, and make sensitive changes such as key rotation and domain transfer at an agreed time with a rollback plan.
There is no honest flat price before we have seen the product. The drivers are the number of assets and environments, the size of the codebase, whether there are live users and data to protect, and how available the previous team is. After a short read-only look we scope the assessment as a fixed, small engagement with a fixed price and an itemized list of what it covers; if you continue with us, its cost is rolled into the work.
If the question is responsibility — who owns what, and how to take the product over — yes. If the question is specifically about the quality of AI-generated code and how to make it production-grade, the Vibe Coding Rescue page goes deeper into the patterns those tools leave behind.
Vibe Coding RescueIf the product is stable and the question is how to move it off an end-of-life technology without stopping the business, that is modernization. If the question is who takes responsibility for it first, it starts here and may lead to a modernization plan once the product is in your hands.
Legacy System UpgradesYou do — all of it. The repository, the cloud and store accounts, the domain, the keys. Moving every asset into your organization is the first stage of the work, and we hand everything back the same way when the engagement ends.
Yes. After stabilization the work continues either as a defined project for the remaining scope or as a dedicated team with roles and capacity set in the agreement. Many clients also keep an in-house team and use us for the parts they do not want to staff.
Dedicated Product TeamRead-only access to the code and, if possible, the infrastructure and monitoring; a short description of what is stuck and what the business needs from the product; and a list of who currently holds which accounts, even if it is incomplete. The previous vendor's contract helps but is not required for the first look.
Keep reading
- GuideMoving to a new development vendor: what to receive, verify and hand overThe asset-and-owner table, pre-acceptance checks and staged transition plan behind this service, as a guide with a downloadable template.
- ServiceVibe Coding RescueAI-generated code that doesn't work? The patterns Cursor, Lovable and Bolt leave behind, and how we take them to production.
- ServiceLegacy System UpgradesFrom old PHP, jQuery or .NET Framework to modern — in stages, without breaking what works.
- GuideWhat does app maintenance include, and how do you budget for it?Launch is not the end of the spend. What a maintenance agreement buys, and what it does not.
- GuideFixed-scope project vs dedicated development teamHow to choose the engagement model once the product is stable again.
Let's talk
Send us what you have.
Read-only access or a short description of what is stuck, and who holds which accounts as far as you know. We come back with what we would check first and what an assessment would cover — in writing.
Access first. Fixes second.