Hire a developer for an AI-built app: checklist

This list is about people. It is not a code audit.

A code check asks whether the app can take a stranger. This list asks who can hand over the logins. Mix them and you pay a team to wait on a password reset.

Finish five parts before day one: who holds which logins, who owns the database, who owns the domain, who pays which bills, and one page of what is already broken. The incoming developer should be able to read that list on a phone and know where to log in.

If two of those parts are blank, the hire is early. Fill the list. Then send the calendar invite.

Access list: who has which logins today

Write every tool that currently ships the product. Then write the email that can open it. Then write the role that email holds. Then write whether that person still works on the app.

A useful row looks like this:

• Tool — Lovable, Bolt, Cursor Cloud, Replit, Bubble, Framer, Rork, Tempo, Vercel, Supabase, Stripe, App Store Connect, Play Console, Google Analytics, the registrar.
• Login — the exact email, not “founder Gmail.”
• Role — Owner, Admin, Developer, Billing, Viewer. Use the vendor’s word.
• Still needed? — yes, no, or “remove after export.”
• Second person? — name one, or write “none.”

Vendors already tell you which login is the company. App Store Connect role permissions give Account Holder to the person who enrolled. That person alone signs legal agreements, renews membership, and requests App Store Connect API access. Admin is a second contact with access to all apps. Admin is not Account Holder. Play Console user access names three levels: account owner, admin, and user. The owner is the first registered account and the only person who can link a payments profile. Google Play charges a one-time US$25 registration fee to open a Play Console account. Invite the studio as Admin. Do not make them the owner “for now.”

Stripe user roles draw the same line. Administrator can see and manage almost everything, including invites. Administrator cannot change the account owner. Only the owner can transfer ownership. Developer can create secret API keys. Developer cannot invite team members. A hired engineer who needs keys is a Developer. A hired engineer who needs to become the company is a different job — and it is yours, not theirs.

Vercel access roles put Owner at the top of a team. Owners manage billing, members, and every project. Billing is a money login with read-only project access. Developer can deploy and manage environment settings. It cannot run the team. Vercel says to keep at least two Owners so one lost laptop is not a lockout. Supabase access control assigns Owner when you create the org. Administrator cannot add new Owners, cannot update organization settings, and cannot transfer a project out of the org. Developer cannot change project settings. If the hired person needs an export or a transfer, the founder who is Owner has to be in the room.

Google Analytics access management uses Administrator, Editor, Marketer, Analyst, and Viewer. Administrator can add and delete users. Editor cannot manage users. A Pixel or GA4 property that lives under a freelancer’s Administrator login is stuck the first week ads run. Invite the studio as Editor or Analyst. Keep Administrator on a company inbox.

Do the same for the builder itself. Who is the workspace owner on Lovable, Bolt, Cursor, Replit, Bubble, Framer, Rork, or Tempo? Who can invite? Who can export? Who pays the bill? A leftover contractor with Owner on the builder is still in, even if they have not opened the tab in months. Remove or downgrade them before the new developer arrives. Do not share the founder password in a chat. Invite a role.

Database owner: who can export, who holds the project, who pays

The database is the company. Screens are a costume. Name three facts on one line: who can export, who holds the project, who pays the bill.

On Supabase those three facts are not the same login. Access control lets Owner and Administrator manage billing, payment methods, and the subscription. Only Owner can transfer a project out of the organization. Developer can view and manage data, but cannot transfer, cannot pause, and cannot reset the database password. Read-Only on Team and Enterprise cannot download a backup. If the hired developer needs a dump on day one, an Owner has to be available — or you add a second Owner on the company org before they start.

Write the project URL, the org name, and the billing email. Write whether the project still sits on a personal GitHub-linked org created the night the builder made it. Write whether anyone has downloaded a backup in the last 30 days. If the only export path is “ask the builder chat,” you do not have an owner. You have a hope.

Firebase, Neon, PlanetScale, and a Bubble Live database follow the same three questions even when the vendor words differ. Who is the Google Cloud / Firebase project Owner? Who can export? Whose card renews the plan? A Bubble app whose Live data lives in a contractor’s Bubble account is not your database. It is theirs until the app is transferred. Put that fact on the list in plain words so the incoming developer does not spend week one hunting for an export button that will never appear.

Do not paste connection strings into the list. Name the vault. Name the person who can open it. Rotate anything that sat in a builder chat before you invite a new engineer. The hired person should receive a role, not a screenshot of `postgresql://`.

Domain owner: the name the app answers on

The domain is how customers find you. If the registrar login is a contractor, the contractor can move the name. Write who owns the registrar account, who is the registrant, and who can change nameservers.

GoDaddy lets you move a domain to another GoDaddy account. The receiving account has 10 days to accept before the move expires. That 10 days is not a lock. Delegates need Transfer Access. Domains pending a contact update, within one day of expiry, expired, or already pending a transfer cannot move. That is an account move, not a registrar transfer. GoDaddy contact edits are a separate step. If Domain Privacy is off and you change registrant name, organization, or email, the current registrant must approve. Do not confuse “I can log in” with “the company is the registrant.”

Cloudflare’s 30-day lock applies to moving a domain between Cloudflare accounts. The domain must be older than 10 days. The new account has 5 days to approve. Then a 30-day lock. See the Cloudflare Registrar FAQ. Moving to another registrar is a different clock. ICANN blocks that for 60 days after you register, transfer, or change the owner details. If the domain is only hosted on Cloudflare DNS, that is a different move. Use move a domain between Cloudflare accounts.

Namecheap, Google Domains, Route 53, and a school registrar all have their own transfer clicks. You do not need to memorize them. You need the login, the 2FA device, the registrant email, and a person who can approve a change this week. If that person is a freelancer who built the first landing page in 2024, move the domain to a company account before the developer starts. A hired engineer cannot “just update the CNAME” from a Vercel dashboard if they cannot open the registrar.

Write four DNS facts on the list: the registrar, the nameserver host (often Cloudflare even when GoDaddy is the registrar), the record that points at the app, and who can change it. If ads, mail, and sign-in use three different hostnames, write that too. The incoming developer should not find a leftover `*.lovable.app` in live DNS on Thursday.

Billing logins: builder, host, Stripe, stores, analytics

Money logins last longer than chat logins. A revoked Slack invite does not stop a card on file. List every vendor that charges you for this app, the last four of the card, the billing email, and who can cancel or change the plan.

Typical rows after an AI builder:

• Builder — Lovable, Bolt, Cursor, Replit, Bubble, Framer, Rork, Tempo. Workspace owner and billing owner may differ.
• Host — Vercel, Netlify, Fly, Railway, the builder’s own publish host. Vercel Billing can see invoices without deploying. Owner can change the plan.
• Database — Supabase, Firebase, the Bubble Live plan. Owner or Administrator updates payment methods.
• Stripe — Administrator invites. Only the owner transfers the account. Developer can mint secret keys. Do not hand the owner login to a contractor.
• Apple — Account Holder renews membership and signs agreements. Transfer the Account Holder role is a legal process to another employee with binding authority. It is not an Admin invite.
• Google Play — account owner is the only person with a linked payments profile. Ownership transfer is a separate Play Console flow. Invite the studio as Admin. Keep the account owner on your company.
• Analytics — GA4 Administrator can grant anyone, including themselves, full control. Keep that on a company inbox. Invite the studio as Editor or Analyst.

A card on a personal Amex is fine for a weekend prototype. It is a risk on a hired sprint. If the founder’s card dies, Vercel, Supabase, and Stripe pause on their own clocks. The incoming developer cannot unpause a billing lockout from a Viewer login. Move paid plans to a company card, or name a second Owner who can update the card without the founder’s phone.

For GitHub org transfer, use one line and stop: follow GitHub handoff after an AI builder. This list does not rehash remotes, branch rules, or Actions secrets.

One-page “what’s broken” note

The incoming developer should not spend day one reconstructing folklore. Write one page. Date it. Put your name on it. That is the last part.

Keep it ugly and true:

• What works for you and fails for a stranger. Login, checkout, a file upload, a magic link that still prints localhost.
• What you have never tried. Password reset, a second user, an export, a domain change, a store screenshot.
• What a contractor left. Extra Owner logins. A webhook on their Stripe. A DNS TXT they never wrote down.
• What you already know is wrong. A table anyone can read. A secret in the builder chat. A personal Apple ID “just for TestFlight.”
• What you want them to ignore. Visual polish. A second platform. A rewrite debate you have not opened.
• Who answers in 24 hours. Name one person. If that person is on a plane, name a backup.

This note is not a spec. The spec belongs in the partner brief. This note is the landmines. A hired studio that reads it on Sunday will not bill you on Monday to find them. A hired studio that does not get it will invent a discovery week you already lived.

Do not pad the page with screenshots of happy paths. Do not hide the personal Gmail. Do not write “should be fine.” If a login is unknown, write “unknown.” Unknown is a fact. Fine is a wish.

Treat those bars as time you set aside, not a quote. The short bars are the list. The long bar is the miss: a hired developer watching a founder hunt for a GoDaddy 2FA code while the clock runs.

When the list is still incomplete

Keep the product up. Delay the start date if any of these are still true:

• Nobody can name the email that opens the builder, the host, and the database.
• The Stripe account owner, Play owner, or Apple Account Holder is a contractor or a personal inbox you cannot recover.
• The registrar login is gone, or 2FA sits on a phone you do not have.
• There is no second Owner on Vercel or Supabase, and the founder will be traveling the first week.
• The “what’s broken” page is a folder of screenshots with no date and no name.
• You still plan to paste the founder password into a Slack DM on Monday.

A single unpaid money login is enough to wait. Fill it. Then start. Hire for access you can grant — not for a scavenger hunt.

Next steps

Walk the parts in order. Write the access list. Name database owner, exporter, and billing. Name registrar and DNS. Move money logins to the company. Remove leftover Owners. Write the one-page broken note. Invite the hired role. Then start — or wait one week and save a billed stall.

CodeCross is a product studio. The week before a hire is named logins, named owners, named bills, and one honest page of what is already broken. The Austin app development company page is the studio brief. If a money login or a registrar is still a personal inbox, book a conversation.

A hired developer can fix an app they can open. They cannot invent an Account Holder, a Play owner, or a domain registrant. Show the list. Then let them start.

FAQ

Who should hold the Lovable, Bolt, or Cursor seat the week a developer starts?

A company inbox, with the founder as Owner and the hired person on an invite — not the founder password. Remove leftover contractors first. The builder login is an account. A shared password is not an access list.

Can a hired studio export my Supabase project if I am not Owner?

Not the transfer. Supabase access control lets only Owner transfer a project out of the organization. Administrator can manage billing and cannot add new Owners. Developer cannot change project settings or reset the database password. Add a second company Owner before day one, or be in the room for the export.

What if the domain still sits in a contractor’s GoDaddy login?

Move it before the sprint. GoDaddy can send a domain to another GoDaddy account. The receiving account has 10 days to accept before the move expires. That 10 days is not a lock. A hired engineer cannot change the CNAME from Vercel if they cannot open the registrar. If Cloudflare is the registrar, Cloudflare’s 30-day lock applies to moving a domain between Cloudflare accounts. The domain must be older than 10 days. The new account has 5 days to approve. Then a 30-day lock. See the Cloudflare Registrar FAQ. Moving to another registrar is a different clock. ICANN blocks that for 60 days after you register, transfer, or change the owner details. If Cloudflare holds DNS only, use Cloudflare’s DNS move.

Does a Stripe Developer invite let them change the account owner?

No. Stripe user roles say Developer can create secret keys and cannot invite teammates or change the owner. Administrator can invite and still cannot change the owner. Only the owner transfers ownership. Invite Developer for keys. Keep the owner on the company.

Which App Store Connect role should the incoming developer get on day one?

App Manager or Developer, not Account Holder. Role permissions give Account Holder to the person who enrolled. That login signs agreements and renews membership. Transferring Account Holder is a legal process to another employee with binding authority. On Play, invite Admin. Keep the account owner on your company.

Is a password dump in a shared note the same as an access list?

No. An access list is tool, email, vendor role, still-needed, and a second person. A dump is a risk. Invite a role. Remove the dump. If GA4 still lists a freelancer as Administrator, they can grant themselves anything. That is not a handoff.

When is the one-page “what’s broken” note done?

When it has a date, your name, what fails for a stranger, what you have never tried, leftover contractor logins, and who answers in 24 hours. Unknown is allowed. “Should be fine” is not. The product brief stays on how to brief a partner. This page is the landmines.