Getting Your Code Back: What to Demand Before You Walk Away

The handover checklist below is the one we run on every transfer. Seven items. The order matters. Each one unlocks the next.

Do not pay the final invoice until all seven are signed off.

1. Repository ownership

The code lives in a git provider. Demand that the repository is moved into your organization or your personal account, with you as the owner, not just a contributor.

Owner means you can revoke their access, manage settings, and prevent force-pushes. Contributor means they still control the repo.

Verify by opening the org settings page yourself.

2. Full commit history, not a squash

Some agencies squash the entire project into one commit before handing over. Cleaner, they say. What they actually did is erase six months of who-did-what.

Demand the original commit history. If they refuse, the answer is we are not signing off until we have it.

3. Every secret, in writing, in your password manager

Every API key, OAuth secret, webhook signing secret, database URL, third-party service login. Demand a written list, with the secret stored in your 1Password or Bitwarden, not in a Google Doc.

Then rotate every secret on the list within 48 hours of receiving them. Assume the old values are still cached on someone's laptop.

4. Cloud and service account transfer

Domain registrar, DNS provider, Vercel or Render project, Supabase or RDS database, Stripe account, S3 buckets, email-sending provider. Every account that was provisioned on your behalf must transfer to your billing.

Make this a written punchlist. Tick each one as the transfer completes. We will sort it out later is how cloud accounts get abandoned and your domain expires.

5. A README that actually works

Clone the repo on a fresh machine and follow the README. If it does not install, run, and connect to the right environments, the handover is not complete.

The README must list every environment variable, every service the project talks to, and the deploy procedure.

6. A runbook

If production breaks at 2am, what does the on-call do? The agency must hand over a one-page runbook covering common failure modes, where logs go, and who to call at each third-party vendor.

Nobody likes writing a runbook. The agency writing one is the cleanest signal that the handover is real.

7. A scheduled goodbye

Not they will be on Slack if we need them. A specific date when the agency's access to your systems is fully revoked. Calendar it. Send the calendar invite. Show up to verify.

Until there is a scheduled goodbye, the handover does not end. We have seen temporary collaborator access live in repos for nine months after a contract closed.

Related reading