--- title: "Handing an AI-built app to a developer: what they need from you" description: "Developers lose a week finding access and context on a vibe coded app. The handover checklist: repo, keys, secrets by name, a brief, and revoking access." url: https://whocanfixmyapp.com/problems/handing-an-ai-built-app-to-a-developer --- [Home](https://whocanfixmyapp.com/) / [Problems](https://whocanfixmyapp.com/problems) / [Code and ownership](https://whocanfixmyapp.com/problems#code-and-ownership) # Handing an AI-built app to a developer: what they need from you VC-51 · Any AI builder · Updated October 2026 · By [Nathaniel Kelley](https://whocanfixmyapp.com/authors/nathaniel-kelley) Quick verdict You can fix this yourself. A checklist you can finish in an afternoon - **How serious**: Low - **Fix it yourself?**: Yes, you can fix this yourself - **Typical cost**: Part of a $49–$800 check or a €99–$990 fix ([prices](https://whocanfixmyapp.com/pricing)) - **Top rated**: [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 **What you see.** You found a developer, and the first week disappears into finding logins, keys and the reason behind each feature. ## Why it happens An AI-built app has no handover document because nobody wrote one. The builder knows the code, you know the product, and the developer knows neither. Most of the first week goes into access. Where is the code, which Supabase project is live, who owns the domain, where do the secrets live, and what was the app supposed to do. Access is also where founders make mistakes. They paste a secret key into chat, which Supabase says never to do, or transfer the whole GitHub repository to the developer's account. The right pattern is to invite people into things you own. Lovable's GitHub sync is two-way, so a developer can edit in their own tools and the changes flow back. Bolt syncs collaborators' changes the next time the owner opens the project. Supabase lets you create secret keys under different names so each can be retired independently when someone leaves. ## Fix it yourself 1. Put the code in a GitHub repository under your own account and invite the developer as a collaborator. Never transfer the repository. 2. Give backend and hosting access through each platform's own team or member settings, not by sharing your password. Never paste a secret key into chat, email or a text message. 3. If the developer needs a Supabase secret key, create a new one named after them in **Settings > API Keys**, so you can delete that one key when the work ends. 4. Write a one-page brief: what the app does, who the users are, which flows make money, and the known bugs in order of pain. 5. List every environment variable by name and where it is set, such as Replit **Secrets**, Supabase Edge Function secrets, or the host's settings. Names only, no values. 6. When the work is done, remove the collaborator, revoke their platform access, and delete the keys you created for them. ## When to get an engineer The handover itself is your job, but the first thing a good developer does with it is a check. Ask for a $49–$800 one-off check before any fixes, so you get a written list of problems and a quote per item. Single fixes then run €99–$990 each, about two days per fix. If the developer asks for your passwords, for the repository to be transferred, or for a secret key over chat, that is a reason to pause and ask why. ## Top-rated companies Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. [How we score](https://whocanfixmyapp.com/methodology#score). - 1 · [Afterbuild Labs](https://whocanfixmyapp.com/companies/afterbuild-labs) · **10.0**/10 · Best for: A check before launch · Free first step · from $49 - 2 · [Redlab](https://whocanfixmyapp.com/companies/redlab) · **10.0**/10 · Best for: A full rescue by one team that keeps building · Free first step · from $490 - 3 · [Vibe Code Rescue (Lev Arakelyan)](https://whocanfixmyapp.com/companies/vibe-code-rescue-lev-arakelyan) · **9.0**/10 · Best for: A one-off check and a cleanup · From $299 [All 79 companies, ranked](https://whocanfixmyapp.com/directory#ranking) ## Check these CODE-01 · High The code lives in a Git repository you own Connect GitHub or export the project. If the builder account is lost, the product should not be. OPS-04 · Medium Secrets live in the host's environment settings Keys belong in environment variables on the server, not in the repository or in front-end code. DATA-02 · Critical No secret keys reach the browser Open your live app, then DevTools, Sources, and search the loaded JavaScript for `sb_secret_`, `sk_live_`, `sk-proj-` and `sk-ant-`. Older Supabase keys are long tokens starting with `eyJ`: decode the middle part of each on your own machine, and if it contains `"role":"service_role"`, your secret key is public. A publishable or anon key in the browser is expected. CODE-02 · Medium The flows that make money have tests Sign-up, checkout and the core action. A few end-to-end tests catch most regressions from new prompts. ## Questions ### Should I transfer the GitHub repository to the developer? No. Keep it in your account and invite them as a collaborator. You can remove a collaborator in a minute. Getting a repository back is a negotiation. ### My app is in Lovable. Can a developer work on it without breaking Lovable? Yes. Lovable's GitHub sync works both ways. Changes pushed to the synced branch appear in Lovable, and Lovable's changes appear in the repository. Sources: [Lovable docs: Sync your Lovable project with GitHub](https://docs.lovable.dev/integrations/github); [Supabase docs: API keys](https://supabase.com/docs/guides/getting-started/api-keys); [Replit docs: Secrets](https://docs.replit.com/core-concepts/project-editor/app-setup/secrets); [Bolt Help Center: GitHub for version control](https://support.bolt.new/integrations/git). **Same category** - [Lovable Cloud to Supabase: how to move your data and keep the app working](https://whocanfixmyapp.com/problems/lovable-cloud-to-supabase-migration) - [I don't own my code and there is no GitHub repo](https://whocanfixmyapp.com/problems/i-dont-own-my-code-no-github-repo) - [How to export my Bolt app and run it elsewhere](https://whocanfixmyapp.com/problems/how-to-export-my-bolt-app) - [Can I export my Base44 app?](https://whocanfixmyapp.com/problems/can-i-export-my-base44-app) - [How to move my Replit app off Replit](https://whocanfixmyapp.com/problems/how-to-move-my-replit-app-off-replit) - [The codebase is too messy for anyone to continue](https://whocanfixmyapp.com/problems/codebase-too-messy-for-anyone-to-continue) [All code and ownership problems](https://whocanfixmyapp.com/problems#code-and-ownership) **Run every check** The [production checklist](https://whocanfixmyapp.com/checklist) has all 24 checks with a verdict.