Terminating a relationship with a software development vendor can be a difficult process. If handled incorrectly, it can lead to security vulnerabilities, lost source code, or downtime. In this guide, we outline a transition checklist to secure your technical assets and maintain momentum.
The Security Transition Checklist
Before notifying a vendor of a contract termination, you must secure your cloud and code assets. Our team coordinates these transitions within our software project rescue program to ensure security.
- Verify Git Ownership: Confirm that your business owns the primary GitHub or GitLab organization. Ensure that you have root administrative access and that the vendor cannot delete the repository or history.
- Rotate Database Credentials: Immediately rotate all database connection strings, API keys, and environment variables to block old developer keys.
- Revoke DNS and Host Access: Revoke access to domain registrars and hosting accounts (Vercel, AWS, Cloudflare).
Executing a Codebase Integrity Audit
Once you have secured the repository, perform a code audit to identify hidden issues and assess technical debt. Run these terminal commands to verify the code history and identify potential issues:
1. Scanning for Committed Secrets
Ensure that credentials are not saved in the commit history. You can use standard git commands or specialized scanners to check for sensitive terms:
# Scan commit messages for sensitive keys or API tokens
git log -p | grep -Ei "(password|api_key|secret_key|database_url)"2. Verifying Deployment Integrity
Verify that the codebase in the main branch matches what is currently running in production. Outgoing vendors occasionally deploy changes directly to the server without pushing the updates to the repository.
# Check for differences between active branches
git diff origin/main..origin/productionStructuring the System Runbook
A successful transition requires clear documentation. Request the outgoing vendor to complete a System Runbook containing the following configuration details:
| Section | Required Details |
|---|---|
| Environments | URLs and credentials for local dev, staging, and production environments. |
| Deploy Pipeline | Step-by-step description of build commands and deployment configurations. |
| Cron Jobs | List of background schedules, event triggers, and database backup routines. |
| Dependencies | Map of third-party APIs (Stripe, Twilio, SendGrid) and access controls. |
Credential Rotation Runbook
To secure your systems, execute this sequence of credential rotations in order:
- Database Credentials: Rotate main DB passwords and execute a forced restart of the database server to terminate active client connection pools.
- Third-Party API Tokens: Revoke existing keys for payment processing (Stripe) and messaging (Twilio/SendGrid) portals, creating new restricted access credentials.
- Cloud Provider Access: Delete AWS IAM user access keys for former developer accounts and update security group configurations.
- Deployment Webhooks: Delete deployment triggers in your host repositories (GitHub/GitLab) and rotate deploy tokens.
Resuming Development
Once credentials are rotated, repository ownership is secured, and the system runbook is updated, your new engineering team can begin development. Documenting these configurations simplifies the transition and allows new developers to deploy updates in days instead of weeks.