It got built fast. Now it's load-bearing.
Someone in the business built a working tool without waiting for an engineering team. That was genuinely the right call — it exists, people use it, and it solved something real. The trouble starts when it becomes infrastructure without ever being treated as infrastructure.
The specific failure mode is not bad code. It is that nobody can say with confidence what the system does, what it touches, or where it will fail next — including the person who built it, because it was generated rather than designed.
Before you hire anyone, including us.
These are in order, and none of them cost anything. Working through them will also tell you how serious your situation actually is.
- 01
Establish what it can reach.
Which databases, which third-party accounts, whose API keys, what it can write to and what it can delete. Generated code is frequently over-permissioned, because the fastest path to working is the widest set of credentials.
- 02
Find out whether anything sensitive is in it.
Customer records, payment details, health or employment data, anything under a retention obligation. This decides how urgent the rest of the list is.
- 03
Check whether the secrets are in the code.
API keys and passwords pasted directly into files is the single most common issue in this category, and it is usually a same-day fix once someone looks.
- 04
Confirm there are real backups, taken by something other than the app.
Not a copy the app makes of itself. A backup you have restored from at least once.
- 05
Write down what the business would do if it stopped tomorrow.
If the answer is "we couldn't operate," it is infrastructure and should be resourced as such. If the answer is "we'd go back to a spreadsheet for a week," you have more time than the panic suggests.
Four questions that settle it.
- How many people use it, and could they do their jobs without it this week?
- Does it hold data belonging to anyone outside your company?
- Are credentials stored in the code or in a proper secret store?
- Has anyone ever restored it from a backup, successfully?
Cleaning up AI-built software that became load-bearing is now a category of its own, and it is most of what a rescue diagnostic finds. The usual outcome is not a rewrite — it is a short list of things that are genuinely unsafe, a longer list that is merely untidy, and a clear view of which is which.
If you want someone to read it properly.
A paid diagnostic is from $750, two to five days, scoped on a short call before you pay anything. You get what is actually there, what is wrong, what it costs to fix, and a plan you keep — with us or with anyone else.