Twenty-one days from an undocumented Node.js system nobody dares deploy, to one your team can read, test and ship. Fixed fee of $6,500. Agencies that take this work on start at $80,000 a year and won't quote you until you've sat through a sales call.
Representative figures from a mid-size NestJS and PostgreSQL codebase. Yours will differ — the diagnostic tells you by how much before you commit to anything.
Three routes into the same situation. The symptom is identical in all of them.
One person built the whole backend and then quit. No handover, no documentation, and nobody else who ever understood how it fits together.
The contract finished or the relationship broke. You own a system you have never seen the inside of, and you are not certain you hold every credential.
It shipped quickly with an AI assistant and it worked, until it didn't. The architecture drifted, nothing is tested, and now nobody wants to be the one who deploys.
Whichever route you took, the symptom is the same: your team stopped shipping because nobody is willing to be the person who breaks production. That costs you every week in features you don't ship — and eventually in the incident that finds you anyway.
Each week ends with something in your hands. If week one says the honest answer is a rewrite rather than a rescue, you get that in writing and we stop there.
Every service, job, queue and integration inventoried. Architecture and data flow mapped from the code, not from what anyone remembers. Dependencies scanned against known vulnerabilities.
The critical findings get fixed. Your core flows get characterisation tests — tests written against what the system actually does today, so that changing it stops being a gamble.
The point of the engagement is that you do not need me afterwards. Everything I learned goes into your repository in a form your next engineer can read.
This is the core of the diagnostic, and the thing most teams have never had: every finding with a severity, a location, and an honest estimate of what it takes to fix.
| Ref | Finding | Severity | Fix |
|---|---|---|---|
| R-01 | Three admin endpoints reachable with a valid token but no role check | critical | 4 hours |
| R-02 | Database credentials committed in git history, still valid | critical | 2 hours, plus rotation |
| R-03 | Deploys overwrite in place; there is no path back to the previous version | critical | 1 day |
| R-04 | Payment webhook has no idempotency guard — retries double-charge | critical | 6 hours |
| R-05 | Kafka consumer commits offsets before processing; failures lose messages silently | high | 4 hours |
| R-06 | 14 dependencies with published CVEs; 3 are reachable from request handlers | high | 1 day |
| R-07 | Checkout flow has no automated test of any kind | high | 2 days |
| R-08 | Request logs capture full payloads, including customer email and address | high | 3 hours |
An anonymised composite drawn from real findings. Yours arrives in the same shape, with the file and line for each entry.
Not by cutting scope. Reading an unfamiliar codebase by hand is the slowest part of this work, and it is the part that no longer has to be slow.
| Step | How it is usually done | How we do it |
|---|---|---|
| Understand the system | Two to three weeks reading code and interviewing whoever is still there | Static mapping of architecture, call graphs and data flow in a day or two, then reviewed by hand before any of it is trusted |
| Documentation | Weeks of manual writing, which is the first thing cut under deadline | Drafted from the code itself, then corrected against observed behaviour |
| Find the risks | Line-by-line review with whatever time is left over | Semgrep, npm audit and CodeScene across the whole repository, then a manual security review |
| The missing tests | The slowest task, and the one that gets dropped from scope | Characterisation tests generated against real behaviour, then hardened by hand |
| Refactor and ship | Avoided entirely, because there is no safety net | Incremental changes behind the new test suite, CI, and a rollback that has been exercised |
To be plain about it: tooling accelerates the reading and the first draft. Every finding, every fix and every line that reaches your repository is reviewed by a person who is accountable for it. You are not buying generated output.
For comparison: a focused code audit runs $2,000 to $5,000 on the open market and a comprehensive one $5,000 to $10,000 — both delivering a report and nothing more. A fractional CTO runs $5,000 to $25,000 a month.
Half on start, half on delivery. You have already paid once for someone who didn't finish. There is no reason for you to carry that risk a second time.
Two of these are live products you can open right now. The third is the platform I architect in my day job.
Senior Node developer, 2023 to present
Architected a platform consolidating CRM, records, scheduling and multi-branch operations for a clinical group.
Sole architect and developer — tujade.com
A multi-tenant ERP for small and mid-size businesses, with double-entry accounting as the system of record.
Sole architect and developer — micanchaya.com
Tournament management and ticketing, with a paying client running live competitions on it.
Twelve years building software, and almost all of it remote for teams that were not in my country — Ecuador, Argentina, El Salvador, the United Kingdom and Mexico. Working across a timezone with people I have never met in person is not something I would be trying for the first time on your project.
The last four of those years have been Node.js, NestJS, React and event-driven systems on Kafka. In my current role I architected a medical platform that 600 internal staff and a thousand daily prospects depend on, built the Kafka pipelines carrying five thousand events a day through it, and led the migration off the monolith into microservices. I mentor three developers on that team.
Before that came a stretch that turns out to matter for this work: a period as an IT security specialist for a UK company, automating server and workstation monitoring and triaging incidents across global teams — and, earlier, support engineering from level one through level three. Walking into a system that is already failing, with people watching, is familiar ground.
I also run two products of my own. One of them, a multi-tenant ERP, has around a hundred Jest and Playwright suites sitting behind an automated quality gate. I mention the test count specifically because tests are the thing almost everyone skips, and they are the thing your rescue depends on.
Ambato, Ecuador. UTC−5, which is New York's working day. English C1, Spanish native.
Because you are not paying for an agency. No account manager, no sales team, no office, and no junior being trained on your project after the contract is signed. One senior engineer does the work, and modern tooling removes most of the weeks that used to go into simply reading the code.
A fair question, and it is exactly what happened to you last time. It is also why the deliverable is built so that you do not need me: documentation written from the code, a runbook, an onboarding guide and a recorded walkthrough. The whole point is that the next engineer can pick this up without me in the room. I am glad to work alongside whoever you hire next.
You do, entirely, from the moment it is written. Everything lives in your repositories and your accounts. I will sign your NDA, or use mine if you would rather.
That is what the diagnostic is for. Five days in you get an honest assessment, and if the right answer is a rewrite rather than a rescue, the report says so. I would rather lose the engagement than sell you three weeks of work that cannot succeed.
Ambato is UTC−5 — the same hours as New York, Toronto and Miami, an hour from Chicago. Your standup is at standup time. This is not overnight offshore work where you file a question and read the answer tomorrow.
Node.js and NestJS with PostgreSQL or MariaDB, React front-ends, and Kafka or similar event infrastructure. If your system sits outside that, say so on the call and I will tell you honestly whether I am the right person for it.
Bring the repository, or just describe what happened. You will leave the call knowing what the work involves and what it costs, whether or not you hire me.