Replacing your software vendor or freelancer
Taking Over a Software Project from Another Vendor
When the vendor or freelancer who built your product leaves, stops answering, or has to be replaced, Briebug takes it over safely. Your accounts first, then the old access gone, then a clear plan.
How a takeover works
Six steps, in this order. Each one makes the next safe. If your developer has only just stopped answering, start with what to do in the first 48 hours.
Access and ownership
First, everything the product runs on is put in accounts you own. It is easier when the old vendor helps, but it is not necessary: we can recreate accounts, and contact service providers to transfer them.
- Source code repositories
- Cloud accounts and hosting
- Domains and DNS
- App stores: the developer accounts that publish your mobile apps
- Third-party keys for every service the product calls, such as payments
Depending on the number of accounts, this can take a few days to a few weeks. It depends most on how willing your old vendor is to help.
From the PSIA / SnowPro case study We built a new Azure DevOps environment owned by PSIA and moved all repositories, pipelines and documentation into it, which removed the dependency on third-party infrastructure.
Read the PSIA / SnowPro case studyRotate credentials and remove the old vendor's access
Every credential the old vendor could have seen is replaced, and their access is removed.
- Rotate passwords, tokens and API keys, including any hardcoded in the code
- Move secrets out of the code and into a vault
- Revoke old VPN, SSH and user accounts
From the Cultivate case study We removed the hardcoded Square credentials and rotated all tokens, hardened AWS and RDS access, revoked obsolete VPN and SSH access, standardized access and password rotation across Forge and DigitalOcean, removed lingering access through GitHub, Vercel and DNS, and enforced least privilege across the infrastructure.
Read the Cultivate case studyFrom the Strata GPO case study All secrets moved into Azure Key Vault, each service reading only its own through a managed identity, with soft delete, purge protection and audit logging.
Read the Strata GPO case studyBuild and deploy from accounts you own
The code must build and deploy from your accounts, not from someone's laptop.
- Get the code building from a clean checkout
- Pipelines that deploy from your accounts
- Plan to run the new path alongside the existing production environment during the transition
Assuming the previous vendor has not done anything to bring the site down, we guarantee that the site will not go down as we take it over and begin the new work.
From the Restore United case study CI/CD pipelines, staging environments, and Azure DevOps pipelines deploying into AWS. The new infrastructure ran alongside the existing production environment during the transition.
Read the Restore United case studyKnowledge transfer
We learn the system from whatever documentation exists, and from the code itself.
- Read what is there: documents, tickets, pipeline configuration and the code
- Talk to the people who build and use the system
The Technical Assessment
Then a fixed-fee Technical Assessment tells you what you now own.
- $10K fixed fee, about 1 week
- A comprehensive report that you can take to anyone
- A triage report of what to fix, and in what order
- A milestone-based estimate for the work
- No source code? The assessment focuses on whether we believe we can help you, based on what we can get to. If we can't help you, we will return your money.
Stabilize, then hand it back
We fix what the assessment found, then hand the project back to your team, running.
- Stabilize: fix the release pipeline, add the tests that make change safe, and close the security gaps
- Hand it back: documentation of what we changed and why, and pairing until your team owns it
Case studies behind these steps
Cultivate
Premium gifting platform
- Problem
- Feature development had stopped. Releases shipped with bugs, and a system defect let purchases go through outside approved price ranges.
- What we found
- Environments that did not match, no formal delivery process, hardcoded payment API credentials, and old VPN and SSH access nobody had reviewed.
- Result
- Four aligned environments, one agile process in Jira, rotated credentials with least-privilege access, and features that ship predictably.
PSIA / SnowPro
Education, certification and membership platform for ski instructors
Angular 7 to 17and .NET Core 3.1 to .NET 8 (LTS)
- Problem
- Angular 7 and .NET Core 3.1 nearing end of life, failing test suites, and infrastructure that depended on a third party.
- What we found
- Jest and Cypress suites that broke during the upgrade, an end-of-life identity server, WordPress plugins that failed on PHP 8, and a planned Azure subscription transfer that risked major downtime.
- Result
- Angular 7 to 17, .NET Core 3.1 to .NET 8, working test suites, and repositories, pipelines and documents in an Azure DevOps environment PSIA owns.
Strata GPO
Member portal for a group purchasing organization
2,137customer accounts created in Microsoft Entra on release night, with zero errors
- Problem
- An independent security assessment flagged critical weaknesses in a live portal that thousands of members use every day.
- What we found
- Credentials stored in the portal's own database with no second factor, internal services that did not check callers, hardcoded secrets, and manual releases.
- Result
- MFA sign-in through Microsoft Entra, every service verifying every caller, secrets in Key Vault, and automated, scanned releases. 2,137 accounts migrated with zero errors.
Restore United
Business management platform for restoration companies
- Problem
- Technical debt was slowing the product: outdated Angular, manual deployments, an incomplete QuickBooks integration, and a mobile app that could no longer ship.
- What we found
- Deprecated Cordova mobile tooling, an expired Android developer account, features left incomplete by an old QuickBooks integration, and a production TLS certificate problem.
- Result
- Current Angular in an Nx monorepo, CI/CD into AWS, secrets in Secrets Manager, a working QuickBooks integration, and mobile apps that can ship again.
Questions about taking over a project
Will the old vendor have to cooperate?
It is easier if we can work with your old vendor to transfer the accounts, but it is not necessary. We can recreate accounts, and contact service providers to transfer accounts to you. Then we rotate the credentials and remove the old vendor's access, so the project no longer depends on them.
What if we don't have the source code?
It is more challenging. We look at what is available and recreate the rest as needed. Without source code, the Technical Assessment focuses on whether we believe we can help you, based on what we can get to. If we can't help you, we will return your money.
How long does a takeover take?
Depending on the number of accounts, this can take a few days to a few weeks. It depends most on how willing your old vendor is to help. After that, the Technical Assessment takes about 1 week.
Will the site go down during the takeover?
Assuming the previous vendor has not done anything to bring the site down, we guarantee that the site will not go down as we take it over and begin the new work. From the Restore United case study: CI/CD pipelines, staging environments, and Azure DevOps pipelines deploying into AWS. The new infrastructure ran alongside the existing production environment during the transition.
How do we make sure the old vendor can no longer get in?
We rotate the credentials and remove their access. From the Cultivate case study: We removed the hardcoded Square credentials and rotated all tokens, hardened AWS and RDS access, revoked obsolete VPN and SSH access, standardized access and password rotation across Forge and DigitalOcean, removed lingering access through GitHub, Vercel and DNS, and enforced least privilege across the infrastructure.
Will you sign an NDA?
Yes. We always sign a mutual NDA, to protect both of us. We can set up code escrow, but it is not our preference.
Your vendor is gone. Your product does not have to be.
Book a short call with a senior engineer. Tell us what you have access to today, and we will tell you where the takeover starts.