Developer disappeared: secure your code, domain, hosting and accounts today

When a developer stops replying mid-project, the instinct is to change everything at once. That can lock you out of your own systems or take the live app offline. A better approach is to secure things in order of how much damage losing them would cause. Start with the accounts that control all the others, then protect the code and data, then deal with access and keys.

Silence does not always mean bad intent. People get ill, lose jobs or take on too much. Everything below protects you without accusing anyone.

Before you change anything: write down what you know

Spend twenty minutes making notes. Which services does the project use? Which ones can you log in to yourself? Which ones were set up by the developer, and with whose email address? Is the live site or app still working right now?

Check that the site loads, that you can sign in as a user, and, if you take payments, that the last payment came through. Note the date and time. If something breaks later, you will know whether it was already broken.

Priority 1: your email and your domain

Your domain name is the root of almost everything. It controls where your website points and, very often, where your business email is delivered. Whoever controls email can reset passwords on every other account.

Sign in to your domain registrar and check:

• Whose name is on the account and the domain's registrant record. It should be you or your company.
• The expiry date and auto-renew setting. A domain that quietly expires can be lost. Make sure a working payment card of yours is attached.
• The transfer lock. Keep it switched on so the domain cannot be moved to another registrar without your approval.
• Two-factor sign-in on the registrar account, and recovery details that point to you.

Do the same for your email provider (Google Workspace, Microsoft 365 or similar). Check the list of admin users and remove anyone who should not be an admin.

If the domain is in the developer's name or their registrar account, ask them politely in writing to move it to you. If they do not respond, contact the registrar's support with proof that the domain was bought for your business: invoices, payment records, emails discussing it. Registrars handle these cases differently, and some situations need a lawyer.

Priority 2: hosting and the live app

Next, the account that keeps the site online. That might be Vercel, Netlify, Cloudflare, a VPS provider, a managed WordPress host or an AI builder's hosting.

• If the account is yours, sign in, confirm you are the owner, turn on two-factor sign-in and check the member list.
• If you were only added as a team member on the developer's account, you may not be able to stay there long term. Ask for ownership to be transferred, or plan to move the project into an account you create.
• Check the billing method. If the hosting is paid on the developer's card and they cancel it, the site goes down.
• Look at DNS records. If your domain points to a server the developer personally controls, note it. You will need to move that eventually.

Priority 3: the source code

A copy of the code with its history is the single most valuable thing a new developer can receive.

If you have any access to the repository, make a full backup today. A mirror clone copies every branch and tag:

git clone --mirror https://github.com/OWNER/REPO.git

Store the result somewhere safe, such as an encrypted drive or a private repository in your own account. If the project was built in Lovable, Bolt, Replit or another AI builder, use its export or GitHub connection to get a copy outside the tool.

If the repository sits in the developer's personal account, ask them to transfer it to you or to an organisation you own. GitHub and other code hosts support repository transfers that keep the history.

Once you have the code, run the Repo Health Check on it if it is public. It will show you whether files that look like secrets were committed. You can also paste config files into the Secret Leak Scanner, which works entirely in your browser, to find keys that need replacing.

Priority 4: your data

Code can be rewritten; customer data usually cannot. Make an export of the database and any uploaded files.

• Supabase: check the backups section of your project dashboard and what your plan includes. For your own copy, a developer can run pg_dump against the database connection string.
• Firebase: Firestore has a managed export feature that writes to a Cloud Storage bucket. It needs billing enabled on the project.
• WordPress: most hosts offer a one-click backup, and backup plugins can produce a downloadable copy.

If you run the export yourself, keep the connection string in an environment variable rather than typing it into shared documents:

pg_dump --format=custom --file=backup.dump "$DATABASE_URL"

Priority 5: accounts that touch money

Check every account where money moves:

• Payment providers (Stripe, PayPal, Razorpay and others): who owns the account, and which bank account receives payouts? If the payment account belongs to the developer, customer payments may be going to them. Treat this as urgent.
• App store accounts: the Apple Developer Program and Google Play developer accounts should be in your name. Apps can be transferred between accounts, but only by the current account holder.
• Paid APIs (AI models, maps, email sending): whose card is billed? If it is the developer's, the service may stop when they cancel it.

Priority 6: remove access and replace secrets

Once your backups exist, decide whether you are ending the working relationship. If you are, remove the developer from every account where they are a member: code host, hosting, database, payments, analytics and the domain.

Then look for the less obvious ways in:

• Personal access tokens, deploy keys and SSH keys on the repository.
• Webhooks or integrations sending data to services you do not recognise.
• Scheduled jobs running on a machine the developer controls.
• Admin users inside the app itself.

API keys and secrets they could have seen should be replaced. Do this one service at a time with a short overlap: issue the new key, put it into your hosting environment variables, redeploy, test the feature that uses it, and only then revoke the old one. The guide on giving a developer access without sharing passwords explains how to set things up so the next handover is cleaner.

Contacting the developer

Keep messages short, polite and in writing. For example:

"Hi, I haven't been able to reach you for a while and I hope everything is all right. To keep the project moving, please could you transfer the GitHub repository and the domain to my account by Friday, and let me know of any work that isn't pushed yet. Thank you."

Save copies of what you send and receive. Avoid public accusations; they rarely help and can create legal problems of their own. If your contract covers ownership of the code and the developer refuses to hand it over, get advice from a lawyer where you live. This guide is not legal advice.

Your today checklist

• Note which services you can and cannot sign in to
• Confirm the live site and payments work, and record the time
• Domain registrar: ownership, expiry, auto-renew, transfer lock and two-factor sign-in
• Email admin accounts checked
• Hosting ownership and billing card checked
• Mirror clone of the repository saved somewhere you control
• Database and uploaded files exported
• Payment payouts going to your bank account
• App store and paid API accounts checked
• Written request sent to the developer for anything still in their name
• Access removed and secrets replaced, once backups exist

What comes next

When the essentials are safe, you can think about finishing the project. The developer disappeared with the code page covers the options in more depth, including what to do when you have no repository at all. The Project Handover Checklist Generator helps you turn your notes into a document a new developer can work from. When you are ready, post your takeover for free so developers who pick up abandoned projects can see what is needed and get in touch.