By Codebases written with Claude Code usually run fine and fail on what nobody reviewed: secrets committed to Git, commands run against the live database, and large changes merged without tests. The code itself is often well structured, so a takeover starts with the Git history, not a rewrite.
What Claude Code builds
Claude Code is Anthropic's coding agent that runs in the terminal. It reads and edits the repository, runs shell commands and tests, and can commit and push. There is no default stack or hosting: the project is whatever the founder asked for, from a Next.js app on Vercel to a Python API on a VPS. Project rules live in a CLAUDE.md file.
Where Claude Code apps usually break
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
Testing and real users use separate databases
Experiments and AI agents should never run against production data.
The flows that make money have tests
Sign-up, checkout and the core action. A few end-to-end tests catch most regressions from new prompts.
Dependencies are current and audited
Run npm audit. Critical advisories in packages you ship should be fixed before launch.
Admin actions are checked on the server
Hiding an admin button is not protection. Call the admin endpoint as a normal user and confirm it is refused.
Check it yourself
- Scan the whole Git history for secrets, not only the current files: run
gitleaks detect, or search withgit log -p -S sk_live_. A key that was committed once and removed later is still visible to anyone with the repository. - Read CLAUDE.md and any script that starts the agent. If sessions ran with permission prompts turned off, treat every command in the history as unreviewed.
- Find out which database the agent connected to while building. If it was the live one, look for migrations, deletes and test rows in production data.
- Run the test suite. If there is none, add end-to-end tests for sign-up, checkout and the main action before the next session.
- Review each endpoint and server action for an access check, and run
npm auditor your language's equivalent on the dependencies the agent added.
When to call an engineer
Call an engineer when secrets are in the Git history, when the agent worked against the live database, or when nobody on the team can explain how a request moves through the app.
A one-off check costs $49 to $800. Fixing and hardening an app costs $1,500 to $15,000 and takes 1 to 8 weeks, based on the prices companies publish.
Top-rated companies for Claude Code apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3LazyCodeLab9.0/10Best for: A one-off check and a cleanupFrom $399
Questions
Can an agency take over a Claude Code codebase?
Yes. It is ordinary code in a Git repository, which makes it easier to take over than a project locked inside an app builder. The handover needs the repository, the hosting account, the database and the list of third-party keys.
Should I keep using Claude Code after the takeover?
Usually yes, with rules: a CLAUDE.md that states the conventions, tests that run before each commit, a separate database for the agent, and a human review of every change that touches access or payments.