Developer disappeared? How to get your code and accounts back

It happens more often than people admit. The developer who built your app stops answering messages. Maybe they took another job, got sick, or simply drifted away. Meanwhile the app is live, customers are using it, and you realize you don't have the passwords.

Don't panic, and don't do anything drastic yet. Most of the time you can recover everything. The order you do it in matters.

First: figure out what you already control

Before chasing anyone, take stock. You probably have more access than you think.

• Search your inbox for welcome emails, invoices and invitations from GitHub, Vercel, Netlify, Supabase, Firebase, Stripe, AWS, your domain registrar and any app builder.
• Check card and bank statements for recurring charges. Each one points to an account, and whoever pays often has a path to recovery.
• Try logging in with your email to each service, using password reset where needed.
• Look for shared documents, chat history or handover notes with credentials or a list of services.

Write everything down in one list: service, who owns it, whether you can log in.

Secure the most critical accounts first

Prioritize by how much damage losing each one would do.

1. Domain: if it expires or is changed, your site and email go dark. Confirm when it renews and who the registrant is.
2. Payments: make sure you can log in to Stripe or your payment provider and see payouts going to your bank account.
3. Code repository: the source code is the hardest thing to replace.
4. Hosting and database: where the app runs and where customer data lives.
5. Everything else: email sending, analytics, error tracking and third-party APIs.

Whatever you can access, add yourself as an owner, turn on two-factor authentication with your own device, and make sure billing uses your card.

Reach out the right way

Most disappearing developers aren't malicious. Send one clear, friendly message, by every channel you have, and give a reasonable deadline.

• Thank them for the work and say you're arranging a handover.
• List exactly what you need: transfer of the repository, ownership of each account, and any credentials or notes.
• Offer to pay for their time to do the handover. It's often the fastest route.
• Keep it in writing so you have a record.

If they don't respond

Every major service has an account recovery process, and the strongest evidence is usually proof that you are the paying customer or the business owner.

• Domain registrars can restore control to the registrant if you can prove the domain belongs to your business. A WHOIS or RDAP lookup shows the registrar, although registrant details are often hidden for privacy.
• Hosting, database and payment providers will often help if you can show invoices, payment records or business documents.
• If the code was never in a repository you can reach, check whether the deployed app or the app builder project still has it. Platforms like Lovable, Bolt and Replit keep the code with the project.
• As a last resort, frontend code can be partially recovered from the live site, but backend code and database rules can't be. That's why the repository matters most.

If you have a contract stating that the work belongs to your company, keep it close. If the developer refuses or makes demands, talk to a lawyer before escalating.

Once you're back in

Getting access is only half the job. Close the doors behind you.

1. Remove the old developer's access from every service, once you hold owner rights yourself.
2. Rotate every secret they could have seen: API keys, database passwords, the Supabase service role key, Stripe keys and webhook secrets.
3. Update the app's environment variables with the new values and redeploy, then check that logins, payments and emails still work.
4. Take a fresh backup of the database and confirm you can download it.
5. Store all credentials in a company password manager and keep the account list up to date.

Understand what you've inherited

With access restored, you need to know what state the app is in before the next person touches it. Can it be run and deployed from the repository? Are there unfinished features, known bugs or security gaps? Is there any documentation? A new developer can only take over safely once those answers exist.

And to make sure this never happens again, set up every future account in your company's name and invite developers as members. Losing a person should never mean losing your product.

Deeraf takes over unfinished and abandoned apps: we help recover and secure access, then a Tech Check maps what you have and what it needs, so work can continue with confidence.