The verdict in three sentences
Facing an abandoned web application, the first useful spend is a code audit of 2,500 to 7,000 EUR in France, or 4,000 to 12,000 USD in the US, run over 5 to 10 days, before any promise of takeover or rebuild. In most cases the code is salvageable, but when the audit puts the remediation cost above 60% of a rewrite, rebuilding becomes the rational choice. Whatever the outcome, the business owner must then secure code ownership and portability by contract so it never happens again.
Step 1: recover access first
Without access, no audit is possible. Many owners discover that the domain name, hosting and code repository are registered in the developer's personal name. Recovery takes anywhere from a few hours to several weeks.
| Access to recover | Where to look | Typical delay | Cost if blocked |
|---|---|---|---|
| Domain name | Registrar (GoDaddy, Namecheap, OVH), WHOIS | 1 to 15 days | 0 to 500 EUR (transfer procedure) |
| Hosting and servers | Invoices, cloud account, billing emails | 1 to 30 days | Emergency migration 800 to 3,000 EUR |
| Code repository (GitHub, GitLab) | Invitations, invoices | Immediate to impossible | Partial reconstruction |
| Database and backups | Hosting control panel | 1 to 7 days | Dump from the server |
| Third-party accounts (payments, email, APIs) | Contracts, dashboards | 1 to 14 days | Key rotation |
| App stores (Apple, Google) | Developer accounts | 7 to 30 days | Republish under a new account |
If the contractor stays unreachable, a formal demand letter, followed by urgent legal proceedings where the contract assigns the rights, unlocks most situations.
Step 2: what a code audit covers
A serious audit goes beyond "reading the code". It assesses security, technical debt, dependency health and the ability of a new team to take over.
| Audit area | Content | Duration | Deliverable |
|---|---|---|---|
| Technical inventory | Languages, frameworks, versions, dependencies | 0.5 to 1 day | System map |
| Security | OWASP flaws, secrets in code, vulnerable dependencies | 1 to 3 days | Prioritised vulnerability list |
| Quality and technical debt | Tests, structure, duplication, documentation | 1 to 2 days | Maintainability score |
| Infrastructure | Hosting, backups, deployment | 0.5 to 1 day | Stabilisation plan |
| Data and privacy | Data model, personal data, logging | 0.5 to 1 day | Compliance gaps |
| Costed recommendation | Takeover or rewrite, budget, schedule | 1 day | Reasoned decision |
As a 2026 order of magnitude, a senior auditor bills 600 to 900 EUR a day in France and 100 to 175 USD an hour in the US, hence the ranges above.
Step 3: take over or rewrite
The practical rule: compare the remediation cost (security fixes, framework upgrades, minimal tests, documentation) with the cost of a functionally equivalent rewrite. Above 60%, the rewrite wins, because it yields a clean, documented asset.
| Observed situation | Remediation cost | Recommendation |
|---|---|---|
| Recent framework, structured code, no tests | 10 to 25% of a rewrite | Take over |
| Framework one major version behind | 25 to 45% | Take over with gradual migration |
| Many critical flaws, no structure | 50 to 70% | Partial or full rewrite |
| Abandoned technology or missing source | Over 80% | Rewrite |
Clauses to demand from the next contractor
- Assignment of economic rights to the code upon each payment.
- Code repository owned by your company, with the contractor invited.
- Domain and hosting registered in the company's name.
- Portability: deployment documentation and assisted handover within 30 days.
- Source code escrow for critical applications.
Need a professional website?
Kolonell builds websites that attract clients, optimized for the Sénégalese market. Free quote in 2 minutes.
Mini case study
Marc, owner of a construction equipment rental firm in Nantes (illustrative persona), sees his freelance developer stop responding. His booking application, built for 38,000 EUR, crashes every week. Recovering the domain and hosting: 9 days, 400 EUR. Audit: 6 days at 750 EUR, or 4,500 EUR excl. VAT. Verdict: framework two major versions behind, 14 flaws including 3 critical, remediation estimated at 16,000 EUR versus 42,000 EUR for a rewrite, or 38%. Marc chooses the takeover: 20,900 EUR in total and 26,000 EUR saved compared with a full rebuild.
FAQ
How much does a code audit cost in 2026?
Between 2,500 and 7,000 EUR in France and 4,000 to 12,000 USD in the US, for 5 to 10 days of work. Price depends on application size and the depth of the security review.
What if the developer keeps the domain name?
Send a formal demand letter, then contact the registrar with your proof of payment. The process usually resolves within 1 to 15 days.
When is it better to rewrite the application?
When remediation exceeds 60% of the cost of a rewrite. That is common when the technology is abandoned or critical flaws are numerous.
Who owns the code if the contract is silent?
In France, the developer keeps the copyright without a written assignment clause; in the US, work by an independent contractor is not automatically work for hire either. A written assignment, even after the fact, is essential.
Can you take over an app without the source code?
Rarely in a reliable way: you can sometimes retrieve the code deployed on the server, but without history. In 80% of such cases, a rewrite becomes the rational option.
Let's scope your project. Tell us the technology, the access you hold and your application's critical functions: we will price the audit, the takeover or rewrite, and the stabilisation timeline. Detailed quote within 48 h. WhatsApp +221 77 596 93 33.
Mohamed Bah
Fondateur, Kolonell
Passionate about digital and entrepreneurship in Africa, Mohamed has been helping Sénégalese businesses with their digital transformation since 2020. Founder of Kolonell, he believes every SME deserves a professional and accessible online présence.
