What is a code audit and project takeover?
A project takeover means adopting an application built by another team: auditing the existing code, identifying technical debt, stabilising deployment, documenting the architecture, then resuming development. The goal is to hand control of the product back to the person who owns it.
It is not a rewrite. A rewrite throws away work you already paid for and pushes your next release months out. A takeover starts from what already exists and already works. We propose replacing a component only when that specific component justifies it, and we say so before starting rather than halfway through.
Is this your situation?
Five cases come up again and again. If you recognise one of them, a takeover is probably the right answer.
Your freelance developer stopped replying
The code is there, the person who wrote it is not. Nobody knows how to deploy it, or what breaks if you touch which part.
The relationship with your agency broke down
The relationship is stuck but the product still has to move. The handover has to happen without taking production down on the way.
Your technical co-founder left
The knowledge left with them. The app works, but every change is a gamble because nobody understands the architectural decisions any more.
You acquired a company and its in-house software
The internal tool came with the deal. You have inherited a codebase your team did not write and whose continuity you are now responsible for.
The app was AI-generated and nobody can evolve it
A prototype built with Lovable, Cursor, Replit or Bolt ended up in production. It works, right up until you need to roll it out company-wide, secure it, or simply change it.
What platform hosting does not cover
An app generated by a platform is usually hosted by that same platform, on a subscription of roughly $15 to $25 per month per app. For a tool you use on your own, that is often the right call, and we will tell you so plainly. Three things change the maths.
The subscription threshold
Past $15 a month, a subscription has to justify itself. While the tool serves one person the sum is trivial. Multiplied across apps and users it becomes a budget line somebody will eventually question.
The ceiling you hit on rollout
Platform limits bite the moment the app outgrows individual use: per-app or per-seat pricing, quotas, no granular permissions, no way to connect your company directory. What was fine for one person blocks at organisation scale.
Security is not included
Hosting gives you a URL that responds. It does not give you a security posture: secret management, access control, data isolation, audit logging, GDPR compliance. On an app holding only your own data the stakes were low. As soon as it touches customer or employee data, they are not.
And the code itself
The problems that only surface under real load are the same in every audit: N+1 queries that collapse response times as volume grows, logic duplicated instead of factored out, and no test coverage, so there is no way to change anything without risking a regression.
None of this is a dig at the tools. We use them too. It is simply the checklist to work through before rolling out an app that was generated fast.
Who owns your source code?
This is the first question we ask, before looking at any code. Without the right to modify the sources, a takeover is legally impossible, so the contract gets settled before the engineering.
Check before any takeover
- The contract assigns the rights to the code produced, rather than granting a licence to use it.
- You have admin access to the Git repository, or at minimum a complete archive of its history.
- Hosting, domain name and database accounts are in your name, not the supplier's.
- Proprietary dependencies and API keys are identified, with their licences and renewal dates.
If one of these is missing we help you unblock it before quoting the takeover. That is faster than discovering it mid-project.
How a takeover runs
Three steps, in this order. Each one ends with a deliverable and a decision: you can stop when the audit is done.
- 1
Audit the existing code
We read the codebase, map the architecture, measure technical debt and list security flaws. Deliverable: a report stating what is sound, what needs work, what should be dropped, with a costed estimate against each item. Two to five days depending on project size.
- 2
Technical handover
We get the project into a state a team that did not write it can work in: reproducible development environment, tests on the critical paths, architecture documentation, automated deployment pipeline. After this step, making a change is no longer a gamble.
- 3
Production migration and new features
We move hosting onto infrastructure you control, set up monitoring and backups, then move on to product work. At that point we are your development team.
How much does a code audit cost?
Our prices are public. The audit is fixed-price, so you know what the first step costs before committing to anything after it.
| Service | Price | What you get |
|---|---|---|
| Code audit | €2,500 fixed | Full audit report: architecture, technical debt, security, costed estimate of the work. No commitment to what follows. |
| Technical handover | from €800 per day | Stabilisation, tests, documentation, deployment pipeline. The number of days comes out of the audit rather than a blind estimate. |
| Product development | from €800 per day | Building new features once the project is back under control. |
What moves the number of days
- The size of the codebase and how many services have to be taken on.
- Existing test coverage. With no tests, tests have to be written before anything can change safely.
- The age of the dependencies and the language runtime. An unsupported version forces an upgrade before anything else.
- The state of deployment. An undocumented manual deploy costs more to take over than an automated pipeline.
The €2,500 audit is deliberately a short commitment. If our conclusion is that the project should not be taken over, we say so and you keep the report.
Frequently asked questions
What is a code audit?
A code audit is an external review of an application's codebase. It covers architecture, code quality, test coverage, security and technical debt. It produces a report listing what is sound, what must be fixed, and what each fix represents in effort.
How much does a code audit cost?
At Reflekt Lab a code audit is fixed-price at €2,500, running two to five days depending on project size. The takeover that follows starts at €800 per day, and the number of days is estimated from the audit's findings rather than guessed beforehand.
Does everything have to be rewritten?
Almost never. A full rewrite discards work you already paid for and pushes your next release out by months. In the large majority of cases the right answer is to stabilise what exists, add tests on the critical paths, then replace the problematic components one at a time.
Can you take over an app built with Lovable, Cursor or Replit?
Yes, provided the source code can be exported. The usual concerns on these projects are security, missing tests, unoptimised queries and dependence on the original platform's subscription. The audit starts by confirming the export is complete and workable.
Who owns my application's source code?
It depends on your contract. A development engagement may assign the rights or merely license the software to you. Without the right to modify the sources, no other supplier can legally take the project on. It is the first thing to check, before any technical audit.
What if my current supplier has stopped replying?
We can work from whatever you have access to: the Git repository, a code archive, or in difficult cases the deployed application itself. We also help you recover missing access, particularly hosting and the domain name, which should be in your name.
How long does a project takeover take?
The audit takes two to five days. The technical handover generally runs two to six weeks depending on project size and test coverage. The two steps are separate precisely so that you decide on the second with a costed figure rather than a blind estimate.
What is in the audit report?
An architecture map, an inventory of dependencies and their support status, security flaws ranked by severity, a test coverage measurement, the failure points expected under load, and a per-issue estimate in days. The report is yours, including if you do not continue with us.
Which technologies do you work with?
Mainly Go, Python, TypeScript and React with PostgreSQL, on Kubernetes or managed platforms. We also audit PHP, Symfony and Node.js projects. If a technology falls outside what we can support, we say so before accepting the engagement.
What if the app has no tests at all?
That is the most common case and it does not block a takeover. The first task is writing tests for the critical business paths, the ones where an outage costs money. They act as the safety net for everything after. It is also the single biggest driver of the estimated day count.
Lost control of an application?
Tell us what happened and which technologies are involved. We will tell you honestly whether a takeover is worth it, and what it would take.
