{"id":988635,"date":"2026-10-06T14:00:00","date_gmt":"2026-10-06T14:00:00","guid":{"rendered":"https:\/\/croncodestudio.com\/en\/?post_type=croncode_post&#038;p=988635"},"modified":"2026-09-08T22:58:43","modified_gmt":"2026-09-08T22:58:43","slug":"how-to-handover-a-codebase-to-a-studio","status":"publish","type":"croncode_post","link":"https:\/\/croncodestudio.com\/en\/journal\/how-to-handover-a-codebase-to-a-studio\/","title":{"rendered":"How to Handover a Codebase to a Studio"},"content":{"rendered":"<div class=\"vgblk-rw-wrapper limit-wrapper\">\n<p>A handover is how a new team can change the product without folklore. If you are leaving a freelancer, changing studios, or inviting <a href=\"\/en\/\">Croncode<\/a> onto an existing app, the packet matters more than a kickoff vibe. This is the inbound checklist we ask for. Quote shape: <a href=\"\/en\/journal\/what-to-send-when-requesting-a-software-quote\/\">what to send<\/a>. Security before you sign: <a href=\"\/en\/journal\/security-questions-before-you-sign\/\">security questions<\/a>.<\/p>\n<blockquote class=\"croncode-kisa-cevap\">\n<p>Handover a codebase with repo access, store roles, secrets in a company vault, and a written debt list. A zip in chat is not a handover.<\/p>\n<\/blockquote>\n<h2>What belongs in the first drop?<\/h2>\n<ol>\n<li>Git remote the company owns, not a personal laptop path.<\/li>\n<li>Apple org roles. You stay Account Holder. <a href=\"\/en\/journal\/who-owns-the-app-store-account\/\">Account ownership<\/a>.<\/li>\n<li>Bundle ID, signing, and where dSYMs go. <a href=\"\/en\/journal\/crash-free-sessions-what-founders-should-ask\/\">Crashes<\/a>.<\/li>\n<li>Secrets in a vault, rotated if a past contractor still has them.<\/li>\n<li>A debt list: known crashes, hardcoded strings, hidden admin. <a href=\"\/en\/journal\/client-app-and-internal-tool-same-codebase-risks\/\">Shared codebase risks<\/a>.<\/li>\n<\/ol>\n<p>If a marketing site exists, handover host and DNS separately: <a href=\"\/en\/journal\/php-cpanel-deploys-for-product-marketing-sites\/\">cPanel deploys<\/a>. Do not put WordPress admin passwords in the iOS repo.<\/p>\n<h2>Which questions should the outgoing team answer in writing?<\/h2>\n<table>\n<thead>\n<tr>\n<th>Topic<\/th>\n<th>Ask<\/th>\n<th>Fail signal<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Store<\/td>\n<td>Who can upload today<\/td>\n<td>\u201cI use my personal team\u201d<\/td>\n<\/tr>\n<tr>\n<td>Privacy<\/td>\n<td>SDK list vs label<\/td>\n<td>Shrug. <a href=\"\/en\/journal\/choosing-analytics-without-surveillance\/\">Analytics<\/a><\/td>\n<\/tr>\n<tr>\n<td>Deletion<\/td>\n<td>Where the script lives<\/td>\n<td>Founder laptop. <a href=\"\/en\/journal\/data-deletion-requests-in-small-apps\/\">Deletion<\/a><\/td>\n<\/tr>\n<tr>\n<td>Support<\/td>\n<td>Which inbox<\/td>\n<td>Dead alias. <a href=\"\/en\/journal\/support-email-as-a-product-surface\/\">Support<\/a><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>References on the old studio: <a href=\"\/en\/journal\/how-to-check-istanbul-studio-references\/\">check references<\/a>. Istanbul hiring: <a href=\"\/en\/journal\/hiring-an-app-team-in-istanbul-what-to-check\/\">what to check<\/a>.<\/p>\n<h2>When should you pay for a discovery week first?<\/h2>\n<p>When there is no test target, no README, or the binary on the store does not match the default branch. Commercial: a short fixed discovery then a retainer is cleaner than a fake fixed price. <a href=\"\/en\/journal\/fixed-price-vs-retainer-for-app-work\/\">Fixed price vs retainer<\/a>. Process: <a href=\"\/en\/journal\/first-app-store-release-fixed-scope-vs-agile\/\">fixed scope vs agile<\/a>. Thin mystery apps: <a href=\"\/en\/journal\/when-an-mvp-is-too-thin-for-the-app-store\/\">too thin<\/a>.<\/p>\n<p>People who will read the packet: <a href=\"\/en\/team\/goktug-unver\/\">Goktug Unver<\/a>, <a href=\"\/en\/team\/yusufhan-sokur\/\">Yusufhan Sokur<\/a>, <a href=\"\/en\/team\/ozgur-ismet-ozkan\/\">Ozgur Ismet Ozkan<\/a>. Shipping: <a href=\"\/en\/journal\/how-croncode-ships-ai-consumer-apps-from-istanbul\/\">how we ship<\/a>.<\/p>\n<h2>How do we prove we can build after handover?<\/h2>\n<p>A sprint demo on a new TestFlight from the company org, not a screenshot of the old Xcode. <a href=\"\/en\/journal\/what-a-sprint-demo-should-show-a-client\/\">Sprint demo<\/a>. Design QA on the first job: <a href=\"\/en\/journal\/design-qa-checklists-for-ios\/\">design QA<\/a>. If AI is in the app, we need the fail-safe and the keys story: <a href=\"\/en\/journal\/how-to-scope-an-ai-feature-that-can-fail-safe\/\">fail-safe AI<\/a>.<\/p>\n<h2>What mistakes make handover hostile?<\/h2>\n<ul>\n<li><strong>NDA theater with no repo:<\/strong> we cannot help.<\/li>\n<li><strong>Leaving a backdoor admin in the consumer target:<\/strong> we will pull it. <a href=\"\/en\/journal\/what-croncode-will-not-build\/\">Will not build<\/a>.<\/li>\n<li><strong>Unowned inspiration in the UI:<\/strong> we will not copy a competitor as a deliverable. <a href=\"\/en\/journal\/competitor-teardowns-without-copying\/\">Teardowns<\/a>.<\/li>\n<li><strong>English-only strings while the store is Turkish:<\/strong> <a href=\"\/en\/journal\/localizing-onboarding-not-just-strings\/\">onboarding localization<\/a>.<\/li>\n<\/ul>\n<p>Hire: <a href=\"\/en\/hire-software-studio\/\">hire<\/a>. Custom: <a href=\"\/en\/custom-software\/\">custom software<\/a>. Contact: <a href=\"\/en\/contact-us\/\">contact<\/a>. Journal: <a href=\"\/en\/journel\/\">\/en\/journel\/<\/a>. Choose us like any studio: <a href=\"\/en\/journal\/how-to-choose-a-custom-software-studio-for-ios\/\">choose an iOS studio<\/a>. Models: <a href=\"\/en\/journal\/software-studio-vs-freelancer-vs-agency\/\">studio vs freelancer<\/a>.<\/p>\n<h2>What does a healthy week-one look like?<\/h2>\n<p>We can archive a build, read crashes, reply to one support thread, and name the first increment. Consumer examples of jobs we already understand: <a href=\"\/en\/app\/yourstyle-ai-stylist-outfit\/\">YourStyle<\/a>, <a href=\"\/en\/app\/numira-navigate-lifes-choices-with-numira\/\">Numira<\/a>, <a href=\"\/en\/app\/spylie-uncover-the-truth-with-spylie\/\">Spylie<\/a>, <a href=\"\/en\/app\/luviport-flawless-journeys-the-premium-experience\/\">Luviport<\/a>. We will not pretend your app is one of these. Catalog: <a href=\"\/en\/journal\/what-croncode-builds-mobile-ai-human-centered\/\">what Croncode builds<\/a>.<\/p>\n<p>If the \u201ccodebase\u201d is only no-code, say what you can export: <a href=\"\/en\/journal\/custom-software-vs-no-code-for-founders\/\">custom vs no-code<\/a>. If you cannot export, we are not taking over a repo. We are estimating a rebuild. Say that in the first call so the commercial shape is honest. A surprise rewrite inside a \u201chandover\u201d fixed price is how both sides lose a month.<\/p>\n<p>Schedule a live archive of a TestFlight from the company org in week one. If that archive fails, stop feature talk. Fix signing. A studio that starts redesigning onboarding while it cannot ship a build is entertaining you. We will not.<\/p>\n<h2>Frequently asked questions<\/h2>\n<h3>Can I handover without the old developer?<\/h3>\n<p>Yes if you own the repo, the store, and the vault. If you do not, start with account recovery, not with features.<\/p>\n<h3>Do you need production customer data?<\/h3>\n<p>No. We need a staging path and a schema. Do not send a live export to a personal chat.<\/p>\n<h3>How long is a handover increment?<\/h3>\n<p>Often one to two weeks to become dangerous in a useful way. A same-day takeover is a myth unless the repo is already clean.<\/p>\n<h3>What if the old contractor refuses?<\/h3>\n<p>You still have Apple if you are Account Holder. Rotate secrets. Treat the old binary as untrusted until you ship your own.<\/p>\n<h3>Will you keep their architecture?<\/h3>\n<p>If it is safe and clear. We will not rewrite for taste in week one. We will isolate a shared admin if it sits in the consumer target.<\/p>\n<\/div>\n<p><!-- .vgblk-rw-wrapper --><\/p>\n","protected":false},"excerpt":{"rendered":"<p>How to handover a codebase to a studio: repo access, store roles, secrets in a vault, and a written list of known debt.<\/p>\n","protected":false},"featured_media":988636,"template":"","croncode_category":[48],"croncode_author":[47],"class_list":["post-988635","croncode_post","type-croncode_post","status-publish","has-post-thumbnail","hentry","croncode_category-studio","croncode_author-yusufhan-sokur"],"_links":{"self":[{"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/croncode_post\/988635","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/croncode_post"}],"about":[{"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/types\/croncode_post"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/media\/988636"}],"wp:attachment":[{"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/media?parent=988635"}],"wp:term":[{"taxonomy":"croncode_category","embeddable":true,"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/croncode_category?post=988635"},{"taxonomy":"croncode_author","embeddable":true,"href":"https:\/\/croncodestudio.com\/en\/wp-json\/wp\/v2\/croncode_author?post=988635"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}