“Not having access to your own source code is the software equivalent of not having the keys to your own building.”
A business owner locked out of their own productWhy This Happens More Often Than You'd Think
You need to recover your source code from a developer and you're not sure where to start. This situation comes up more often than most people expect - developers who set up repositories under their personal accounts, agencies that retain code as leverage for unpaid invoices, or contractors who simply vanished without handing anything over.
In most cases, you legally own the code - assuming you paid for it and had a contract that addresses intellectual property. But legal ownership and practical access are two different problems. Getting the code back usually requires a mix of technical steps, platform processes, and occasionally formal escalation.
This post covers the practical steps to recovering your source code, what to do when the developer isn't cooperating, and how to make sure this never happens again.
Start With What You Can Access Today
Before assuming everything is lost, check every place the code might already be accessible to you. Log in to GitHub, GitLab, or Bitbucket with your own account and look for repositories that were shared with you, even as a collaborator. Check your email for any repository invitation links. Look for any ZIP archives or file exports the developer may have shared during the project.
If the project was hosted on a platform like Vercel, Netlify, or AWS, those deployments often contain a copy of the built code - not the full source, but potentially enough to understand the structure. Some hosting platforms also retain deployment logs that indicate what repository was connected.
- Check GitHub/GitLab/Bitbucket for any repos you were added to as a collaborator or outside contributor
- Look for any automated build outputs or deployment archives in your hosting accounts
- Search your email for links to repositories, staging environments, or file shares
- Check any project management tools (Trello, Linear, Notion) for links the developer may have shared
- Contact your domain registrar and hosting provider - they may have logs of what was deployed
- Look for any CI/CD pipeline configurations that reference a repository URL
When the Repository Is Under the Developer's Personal Account
This is the most common scenario and the one with the clearest path to resolution. If the repository is on GitHub under the developer's personal account and you want it transferred to your account, start with a direct written request. Keep it professional and factual - you're asking for what you paid for, not making accusations.
If the developer refuses or is unresponsive, GitHub's support team can process a repository transfer when you can demonstrate ownership of the underlying work. This typically requires showing a contract, invoices, or other evidence that you commissioned and paid for the project. The process takes time - usually one to two weeks - but it works for the majority of cases.
GitLab and Bitbucket have similar transfer processes. The key is having documentation of your payment and ideally a contract clause stating that IP belongs to the client upon payment. Even a short email thread or invoice with a description of the work can be sufficient.
When the Developer Is Withholding Code as Leverage
Some developers will hold code hostage over unpaid invoices or disputed scope. This is a difficult situation, but it has limits. In most jurisdictions, withholding deliverables after payment has been made is a breach of contract - and using code as leverage to extract additional payment you don't legally owe is worse.
If you're in a dispute, get legal advice before paying under pressure. A payment made to resolve a dispute can inadvertently signal that the demand was legitimate. At the same time, if the developer has a genuine outstanding invoice and you have the funds, paying and resolving cleanly is often faster and cheaper than a formal process.
Rebuilding if the Code Is Truly Unrecoverable
In a small number of cases, recovery isn't possible - the developer deleted the repository, the hosting accounts have expired, or the cost of formal legal action doesn't justify the outcome. In those situations, a partial rebuild is often faster than it sounds.
If you have a working deployed version of the app, a skilled team can reverse-engineer the architecture from the running product. Not the code itself - that's gone - but the structure, the API endpoints, the data model. A well-scoped rebuild based on a working reference often takes 40 to 60% less time than the original build, because the requirements are already proven and the design is already done.
How to Own Your Code From Day One on the Next Project
The simplest protection is also the most overlooked: insist that all code is committed to a repository owned by your company account from the very first day of work. Not a repository owned by the developer that they share with you - a repository in your GitHub organisation that the developer is invited to contribute to.
Pair this with a contract clause that assigns IP to you upon payment, and you have a legally clear and practically enforceable position. Most developers won't object to this arrangement - those who do are worth noting.
Recovering source code from a developer is a solvable problem in most cases, but it's a distraction from building your product. If you're in that situation and need help assessing what you have, recovering what you can, and planning what comes next, Zovintra's rescue service is built for exactly this kind of situation.
