Inherited codebase · Small business · 2024
Ridgeline Outfitters
A custom storefront whose original developer stopped answering email. Nobody left at the company could change a price.
- PHP
- MySQL
- jQuery
- Docker
- 4 yrs
- of unapplied security patches closed
- same day
- price changes, down from not possible at all
- 1 command
- to run the site locally, from no known way to run it
What we inherited
Ridgeline sold outdoor gear through a custom storefront built by a contractor who had since become unreachable. It ran, it took orders, and it was completely frozen — no documentation, no local development setup, no repository the client controlled, and a hosting account in the contractor's name.
What was broken
-
The client did not own their own code
The repository, the hosting account, and the domain registrar were all under the former contractor's control. Every technical problem was downstream of this one.
-
No way to run it anywhere but production
Which meant no way to test a change before customers saw it. Which meant, sensibly, that no changes got made at all.
-
Dependencies four years stale
Including publicly known vulnerabilities in libraries sitting in the payment code path.
-
Business rules encoded in one 3,000-line file
Pricing, shipping, and tax logic interleaved line by line with HTML output.
What we fixed
-
1
Got the client ownership before writing any code
Their own repository, hosting in their name, domain transferred to their registrar account. This was the first week's work, and it's the step that makes everything after it durable rather than borrowed.
-
2
Made it runnable locally
A Docker setup and a seeded database, so a change can be tested before it ships. One command, documented in the README.
-
3
Patched dependencies in small, verified steps
Payment path first, one upgrade at a time, with a manual test pass after each. Slower than a bulk upgrade and far less likely to take the store offline.
-
4
Extracted the business rules and put tests around them
Pricing, shipping, and tax pulled out of the template file into tested functions. We left the rest of the legacy code alone on purpose — it works, and rewriting it was not what they needed.
Ownership is a technical problem
It’s tempting to treat repository access and domain registration as paperwork — the boring part before the real work starts. For an inherited codebase it’s the opposite. It is the real work, and everything else is contingent on it.
As long as the hosting account belonged to someone unreachable, Ridgeline had no ability to recover from an outage, no ability to change providers, and no leverage of any kind. We could have made the code beautiful and they’d still have been one unpaid invoice away from losing their store.
If you’re hiring anyone to build you software, this is the thing to check first, while the relationship is good: is the repository in your organization’s account, is the hosting and the domain in your name, and can you get to all three without asking anyone. If the answer is no, fix that before you commission another feature.
“The first thing they did was put my domain in my name. Two other shops had told me I needed a full rebuild.”
Got something that looks like this?
Thirty minutes, no pitch. We'll tell you what it would actually take.
Book a free 30-min callRather not book a time? Send a message instead.