At some point the question changes from how do I fix this to who fixes this. Maybe the doom loop won, maybe launch is close and the security unknowns are keeping you up, or maybe the app is fine and growing and you want an adult in the room before it matters. Handing an AI-built app to a developer is now a routine transaction, and like every routine transaction it has a right shape: what you prepare, what happens first, what it costs, and the red flags that tell you to keep looking.
Quick answer: Prepare read access to the repo, an inventory of accounts, your prompt history, and a page on what works and what does not. Expect an audit first, at market rates of $500 to $1,000, then a written fix plan with a quote. A good developer keeps your app and your ability to build; instant rebuild pitches are the red flag.
When does a takeover beat continuing yourself?
Three honest triggers. Stakes: users, payments, or sensitive data are live, and the cost of an unverified mistake now exceeds the cost of help. Stuckness: the disciplined self-rescue steps from the doom loop guide have failed twice, which is information rather than failure. Or focus: the app works and the founder-hours going into ops and debugging are worth more elsewhere. A fourth trigger deserves respect too: you never wanted to be the developer, the AI let you skip that role for the build, and production is where the role returns whether you fill it or hire it.
What should you prepare before contacting anyone?
- Repository access, read-only, or the platform’s collaborator invite. If the project only exists inside a builder, connect the GitHub sync first so there is a repo to share.
- An accounts inventory: hosting, database, domain registrar, email, payment provider, and who currently holds each login.
- The prompt history, exported or screenshotted. It documents intent and turning points better than any spec.
- One page in plain language: what the app does, who uses it, what works, what is broken or scary, and what done looks like to you.
An hour of preparation here compresses days out of the engagement, and the inventory has a second job: it shows you where you are dependent on accounts you do not control, which is worth fixing regardless.
What does the audit look at?
Four layers, the same ones every time. Security: secrets, authentication enforcement, database rules, storage, and webhooks, since these are the findings that cannot wait. Data: whether the model underneath is sound, because everything else is renovation while the data model is foundation. Code health: tests, duplication, and the debt patterns that predict how expensive change will be. And infrastructure: hosting, backups, monitoring, domains, and what happens today if something dies at 2am. The deliverable that matters is a plain-language report ranking what is solid, what is fragile, and what order to fix things in, each with a price attached.
What happens after the audit?
A fix plan in phases, and a decision that stays yours. Typical shape: urgent security items first, then stabilization with tests, then the production infrastructure, then a rhythm for ongoing work. You should be able to accept some phases and not others, keep building on the platform in parallel on branches if you want, and see the work land in your own repo with your own accounts throughout. Timelines for a typical app: audit in days, stabilization in one to three weeks, and the handoff artifact at the end is documentation a stranger could run the app from.
How do you vet the developer?
Signals worth trusting: they ask for read access before quoting anything, because pricing without reading is theater. They explain findings in your language and rank them, rather than performing alarm. Accounts and code stay in your name from day one, which is the same ownership rule from our guide on outgrowing a web developer, and it applies double here. And they are fluent with AI workflows: comfortable keeping your build-by-prompting loop alive with guardrails, rather than sneering at how the app was made. The red flags are the inverses, and one is worth naming twice: a confident rebuild everything pitch delivered before anyone has read your code.
What does it cost?
Market ranges in 2026, to calibrate quotes against: audits at $500 to $1,000, stabilization engagements typically in the low to mid four figures, and larger rescues climbing with scope, with ongoing support after that as a monthly plan. The number that matters most is not on that list: it is the audit’s, because it is written after reading your actual code. That sequence (small fixed fee, then an informed quote) is the fair way to buy this, and it is how we structure it. Anyone quoting the big number first is guessing with your money.
Frequently asked questions
Will a developer judge the AI code?
A professional treats it as material. AI-built codebases have consistent, fixable patterns, and they arrive with something human-only projects often lack: a complete history of intent in the prompts. The good ones find that useful, and say so.
Do I hand over my Lovable or Bolt account?
No. Add the developer as a collaborator, or share through the GitHub sync, and keep account ownership yourself. The same rule covers hosting, domain, and database: their access, your ownership, from the first day to the last.
Can I keep building while they work?
Yes, with branch discipline. You keep prompting features on a branch, they stabilize on another, and the deploy pipeline merges what passes tests. Set it up early; it is the difference between a partnership and a turf war.
Should I expect fixed price or hourly?
Fixed for defined phases (the audit, a stabilization scope), hourly or retainer for the open-ended stream afterward. The audit-then-quote sequence exists precisely so the big numbers can be fixed rather than metered.
What if they recommend a rebuild?
Ask for the specific findings that force it, in writing, and weigh them against the rescue-versus-rebuild tests coming later in this series. Sometimes rebuild is honest. It is also the answer that pays the answerer most, which is why it deserves a second opinion.
How long does a takeover take?
Days for the audit, one to three weeks for typical stabilization, and you feel the difference at the first fix that stays fixed. The calendar cost is almost always smaller than the weeks already lost to the loop that prompted the call.