Codebase rescue and legacy modernisation
Inherited something nobody wants to touch — AI-generated, offshored or just old? We make it safe to change again.
There is a specific kind of codebase we see constantly now. It runs. It made it to production. It was generated fast by an AI assistant or assembled by a rotating cast of contractors, and no single person understands it. Every change breaks something unrelated, and the team has quietly stopped touching whole areas.
This is fixable, and almost never by rewriting. We start with an audit: dependency and vulnerability inventory, dead code, duplicated logic, missing boundaries, secrets in the repository, and the specific files where every bug originates. You get a written report with severity, effort and a sequenced plan — useful even if you never hire us for the fix.
Then we stabilise in order. Characterisation tests around current behaviour first, so refactoring is provably safe. Then CI, then the security issues, then the structural work — extracting boundaries, deleting duplication and restoring the ability to ship on a Friday.
The parts that matter.
- 01
Technical due diligence
For investors and acquirers: an independent read on code quality, key-person risk, security exposure, licence compliance and the real cost of the roadmap being promised.
- 02
AI-generated codebase cleanup
The recognisable failure modes of fast-generated code — duplicated near-identical components, hallucinated or abandoned dependencies, no error handling, secrets in source, tests that assert nothing.
- 03
Security remediation
Dependency CVEs, injection paths, broken access control, exposed credentials, and missing authorisation checks on endpoints that were never meant to be public.
- 04
Test harness retrofit
Characterisation tests that pin current behaviour, then targeted unit and integration coverage on the paths that carry money or data. Coverage where it prevents incidents, not everywhere.
- 05
Incremental modernisation
Framework and runtime upgrades, strangler-fig migration away from the parts that must go, and dependency reduction — all behind feature flags, shipped continuously.
- 06
Performance recovery
Profiling to find the actual bottleneck rather than the assumed one: N+1 queries, missing indexes, unbounded payloads, blocking work on the request path, oversized client bundles.
What you
actually receive.
Named artefacts, not a status report. Every item here is something you can open, run or hand to another engineer.
- 01Written audit with prioritised findings, severity and effort estimates
- 02Dependency and vulnerability inventory with a remediation order
- 03Characterisation test suite pinning current behaviour before any refactor
- 04CI pipeline enforcing type checks, lint, tests and security scanning
- 05Refactored core with documented architectural boundaries
- 06Knowledge transfer sessions so your team owns it afterwards
Before you ask.
How long does the audit take?
Two weeks for most codebases, three for large or multi-repository estates. You receive a written report and a walkthrough. It is a standalone engagement — there is no obligation to continue with us afterwards.
Should we just rewrite it?
Almost never. Rewrites discard years of encoded business rules that nobody wrote down and typically take three times the estimate. Incremental modernisation keeps you shipping throughout. We will say when a rewrite genuinely is the answer, and it is rare.
Can you work on a codebase in a language you did not choose?
Yes. We regularly work in PHP, Java, .NET and Python monoliths we did not write. The reading skill transfers; the discipline of stabilise-then-refactor is language-agnostic.
Tell us what you are building.
A short conversation is usually enough to tell whether we are the right firm for the problem. If we are not, we will say so and point you somewhere better.