# Vibe coding vs a freelance developer in Dubai: what breaks after handover
What breaks after handover, and when it shows up
The code is rarely the problem. In the projects I get pulled into after a developer leaves, the first thing missing is access: the repository sits in a personal GitHub account, hosting runs on someone's individual plan, and the domain is registered to an email nobody can open. Reading an undocumented codebase well enough to quote a fix takes 20 to 60 hours, and at reported Dubai freelance rates of AED 150 to 500 an hour that is AED 3,000 to 30,000 spent before one feature moves.
None of this is an argument against freelancers. I have worked with excellent ones in Dubai, and some of them write cleaner code than agency teams charging six times the rate. What breaks is a delivery model with a single point of failure and no handover step, and that model breaks the same way whether the person is brilliant or average.
The failure has a predictable shape. Weeks one to four look fine, because the developer is still answering messages. Around week six you need a small change and the reply takes three days instead of three hours. In month three something expires: a certificate, an API key, a payment gateway credential, a free-tier hosting plan. That is when you discover the change cannot be made by anyone else, because nobody else can deploy.
A handover, in software terms, means the client can build, deploy and change the product without the original developer. It requires the repository under the client's own organisation account, credentials the client controls and can rotate, a written runbook covering local setup and deployment, and monitoring that alerts the owner rather than the builder. Anything short of that is delivery of files, not handover of a system.
Access: the accounts that turn out not to be yours
Go through this list before the final payment, because after it your leverage is gone.
The repository. A personal account holds the code and it needs to move to an organisation you own. Transferring a GitHub repo carries the issues and the commit history across, but it does not carry the Actions secrets, and CI usually stops working until those are re-entered. Plan for that hour.
Hosting and the database. Vercel, Railway, Netlify, DigitalOcean and AWS all let a developer stand a project up on a personal login in four minutes. The same project cannot be moved to your account in four minutes, and on some platforms the transfer changes the plan and the billing. Managed Postgres is the risky one, because the connection string usually lives inside the developer's dashboard.
The domain and DNS. Check the registrar login, not the WHOIS record. A domain that renews on a card you do not own is a domain you will lose on a date you did not choose.
The payment gateway. Whether it is PayTabs, Telr, Stripe or a bank-provided gateway, the merchant account has to sit under your trade licence and your bank details. If a developer set up a gateway account in their own name to speed things up during testing, that has to be rebuilt properly before you take real money through it.
Model and third-party API keys. OpenAI, Anthropic, WhatsApp Business API, Google Maps, a courier API. Each one has an owner account with a payment method attached, and each one stops working when that card is cancelled.
The only reliable test of all of the above takes fifteen minutes. Revoke the developer's access to everything while they are still contracted and friendly, then deploy a one-word change yourself, or watch a second engineer do it. If it deploys, you own the product. If anyone says "let me just get that key from him", you do not.
Credentials in the code, and why deleting them is not enough
Hardcoded keys are the most common defect I find in inherited codebases, and the second most common is the belief that they were removed. Deleting a key from a file does nothing to the commit that introduced it. The value stays in the git history, readable by anyone who clones the repository, and it stays there through every future commit.
Two commands find most of it. git log --all -S "sk-" searches every commit for content containing the string. git log -p -- .env shows whether an environment file was ever committed at all. Run them on any codebase you are taking over, including one built by a company you like.
History can be rewritten with git filter-repo or BFG Repo-Cleaner, and on a small project that takes an afternoon. It does not undo exposure. Any credential that was ever committed must be treated as public and rotated: new key issued, old key revoked, deployment updated. That means the gateway key, the model API keys, the database password, the SMTP credentials, and any admin account that shipped with a default password.
Rotation is also the cleanest way to close a contract. When the last invoice is paid, rotate every secret and remove the developer's accounts the same day. Not because anyone is a suspect. Access that nobody remembers granting is access that nobody remembers to remove.
No runbook, no monitoring: the outage your customer reports
The knowledge gap is quieter than the access gap and it costs more. One person knows the deployment sequence, the environment variables that must be set, the cron job that has to run at 2am, and the reason a particular workaround exists. None of it is written down, because writing it down was not in the scope and nobody asked.
Forget documentation in the corporate sense. A runbook is one file that answers four questions: how do I run this on a laptop, how do I deploy a change, what environment variables exist and what each is for, and what do I do when it breaks. Two pages is usually enough for a tool. Its value shows up the first time a second engineer opens the project and reaches a working local build in an hour instead of a week.
Monitoring is the other half. Most small Dubai builds ship with none, which means the first person to notice an outage is a customer, and the second is you, and the third is the developer who has already moved on. The baseline costs almost nothing: an uptime check hitting a health endpoint every five minutes, error tracking that emails when an exception fires, and an alert on failed payment webhooks. Free tiers cover a small product, and paid plans start around AED 50 to 200 a month.
I care about the payment webhook one specifically. A booking flow that takes money and fails to write the confirmation looks healthy from the outside. Revenue arrives, records do not, and the mismatch surfaces at month end during a manual reconciliation. On our own studio system that gap was worth roughly AED 15,000 in one month before an alert caught it, and the fix was a webhook retry with a daily comparison between gateway charges and CRM deal stages.
The UAE part: permits, visas and who owns the code
This is where Dubai differs from generic handover advice, and where the operational risk sits.
Permit and visa status
A freelancer working legally here holds a freelance permit or a trade licence. Dubai's GoFreelance route runs around AED 7,500 a year for the permit itself, and the first-year total with an establishment card and a two-year residence visa is commonly quoted between AED 12,000 and 13,000. Northern Emirates free zones sell cheaper permits with different conditions.
The number matters less than what it is attached to. A freelance permit is tied to a visa, a visa has an expiry date, and an expired visa means the person leaves the country. A developer who is mid-project when their permit renewal fails is not being unprofessional when they go quiet. They are dealing with something larger than your booking form.
You cannot audit somebody's immigration status and you should not try. What you can do is remove the dependency: if the repository, the hosting and the credentials are yours from day one, their departure costs you a few weeks of onboarding instead of the whole product.
Contracting with a person or with an entity
Ask who issues the invoice. An invoice from a licensed entity, whether a freelance permit holder or a company with a DED trade licence, gives you a counterparty that exists on paper. A payment to a personal account against a WhatsApp quote gives you a phone number.
The same applies to the NDA. An NDA signed by an individual with no licensed entity behind it, referencing a personal mobile number and no address, is difficult to act on if it ever matters.
The IP assignment clause
The one paragraph most small contracts here are missing: a written assignment of intellectual property in the delivered work from the developer to your company, effective on payment, covering source code, designs and any accompanying material. Say it explicitly rather than assuming that paying for something means owning it. Include third-party components too, so you know which libraries carry licences you have to respect.
This is operational guidance from someone who signs these contracts, not legal advice. If the product is central to your business, have a UAE lawyer read the assignment clause once. It is a small fee against the cost of discovering ownership is ambiguous during a funding round or an acquisition.
What a rescue costs against a rebuild
Picking up an unfamiliar codebase is billed higher than writing new code, because the first phase produces nothing visible. The engineer is reading, running things locally, mapping the data model, and finding out what the previous person meant.
| Situation | What it takes | Typical Dubai cost | |---|---|---| | Clean handover, new engineer onboards | Read the runbook, run it locally, ship a change | 4 to 10 hours | | No docs, code readable, access intact | Map the code, restore local build, document as you go | 20 to 40 hours, AED 6,000 to 20,000 | | No docs, no access to hosting or repo | Rebuild the deployment, recreate accounts, migrate data | 40 to 80 hours, AED 12,000 to 40,000 | | No access and no exported data | Often a rebuild from the requirements you can reconstruct | From AED 9,000 for a tool, AED 18,000 for an MVP |
Those hour ranges are what I see in practice, and the AED figures apply the reported AED 300 to 500 senior band to them. Your quote will differ.
The uncomfortable arithmetic: the money saved by hiring at AED 3,000 to 8,000 instead of the AED 18,000 an MVP costs with a proper handover disappears the first time a rescue is needed, and the rescue frequently costs more than the original build. That gap is also why a two-week fixed-scope rebuild sometimes beats fixing what exists, and the tier pricing behind that sits in the breakdown of what a working app costs in Dubai. If the alternative you are weighing is a full agency engagement with its own documentation and warranty, the trade-offs are laid out in the comparison of the agency route against a fixed-scope build.
Vibe coding does not fix handover by itself
Worth saying plainly, since we sell AI-assisted builds. An AI-generated codebase handed over badly fails in exactly the same ways as a hand-written one, and it can fail faster. Generated code tends to be verbose, inconsistently structured across files written in different sessions, and comfortable with placing configuration inline where a human would reach for an environment variable. If nobody reviewed it, the next engineer inherits volume without intent.
We put a live engineer on every line before it touches data or customers because of one failure mode, not craft pride: an access-control mistake in generated code passes every test that checks the right user can get in, because no test checks that the wrong one is refused.
Our shape is deliberately boring. The repository is created inside the client's organisation on day one rather than moved at the end. Credentials go into the client's own accounts. The delivery includes a runbook and two weeks of fixes, after which either the client maintains it or keeps a monthly line for changes. Where the thing turns out to be an operational process rather than a product, the automation format runs at AED 6,000 to set up and from AED 1,200 a month, and that monthly fee explicitly buys someone watching it.
The handover checklist, and use it on us too
Print this. Apply it to any developer, agency or builder, ours included.
- Repository sits in an organisation account you own, and you are the owner rather than a collaborator.
- Hosting, database and domain accounts are registered to your company email and your payment method.
- Payment gateway is under your trade licence and your bank details.
- Every API key is issued from your account, and you have rotated all of them at handover.
git log --all -S "sk-"andgit log -p -- .envcome back clean, or the exposed keys are rotated.- A runbook exists covering local setup, deployment, environment variables and failure recovery.
- A second engineer, not the author, has run the project locally and shipped one trivial change.
- Uptime monitoring and error alerts fire to your inbox, not the developer's.
- A database backup has been restored somewhere and verified, not merely scheduled.
- Tests exist on the paths where money or customer data moves.
- The contract assigns intellectual property to your company on payment, in writing.
- The invoice comes from a licensed entity, and the NDA names that entity.
- You know the monthly running cost of every service the product depends on.
- A named person or company owns maintenance from the day the fix window closes.
Fourteen lines. Most of them cost nothing during the build and are expensive to retrofit afterwards, which is the entire point.
If you already have software running and you are not sure how many of those fourteen you would pass, a Growth Audit from AED 3,000 goes through the access, the credentials and the failure points and gives you the list. If you are about to start something and want it built with the handover built in, the scope and price for a fixed-scope build start at AED 9,000 for an internal tool and AED 18,000 for an MVP.
