Software Rescue Consultant

A software rescue consultant takes over software that never shipped, or shipped and keeps breaking, finds what is wrong, and gets it stable. In one rescue, engineering cost fell from $48K to $8.7K a month. In another, a project 6 months late was finished in 3 months.

Software rescue is work on an existing codebase: finding what is broken, deciding whether to repair or rebuild, and getting the project shipped and stable. I do it for U.S. companies of 1 to 10 people, on .NET, Angular, Azure and SQL Server.

CISQ, the Consortium for Information & Software Quality, was co-founded by Carnegie Mellon University's Software Engineering Institute and the Object Management Group, a software standards body, and it develops standards for measuring software quality from the source code. Its 2022 report puts the cost of poor software quality in the U.S. at no less than $2.41 trillion for that year, including about $1.52 trillion in accumulated technical debt.

Client names and industries on this page are replaced with Company A to E, to protect their brands and investors.

Company A paid a team of five engineers about $48K a month while the lead engineer rewrote the whole app from scratch, telling the owner that Angular could not scale and the app was too buggy to stabilize. The app was five Angular versions behind, and the team was writing Angular as if it were plain HTML, CSS and JavaScript.

I spent a month fixing bugs and stabilizing the existing app, with no rewrite, and upgraded Angular to the current version. As the app stabilized, the owner let the other engineers go. Engineering cost fell from $48K to $8.7K a month, and ongoing maintenance and new features now cost under $4K a month.

Company B's first version cost about $15K but was so buggy it could not deliver key features, so a team of American contractors rewrote it. That second version cost about $37K a month for three years, about $1.3M in total, and was still unstable and unmaintainable. Both versions had no proper application architecture.

Repairing the second version would have cost more than rebuilding it. I rebuilt the backend and frontend over 14 months and kept about a quarter of the existing code. Maintenance dropped below $8K a month, then to under $2K a month.

Company C's content management system was about 6 months over deadline and over budget, with five developers who kept missing feature targets and ignoring the design specifications. Nobody on the team really knew how to use Angular or .NET.

Within a month, working with the owner and the CTO, I identified three engineers who could not follow direction or accept training, and the owner let them go. I trained the remaining developer on both frameworks. The project finished in 3 months, before the money ran out, and $55K was freed from developers who could not deliver.

Company E's founder had hired a small firm that kept building the wrong things. He paid a designer for the interface and the firm built a different one. Updates broke what had worked, the developer disappeared for stretches, and the product was never finished. All he had was a desktop script.

The previous developer had given him a download that was missing pieces. I worked with that developer to recover the complete source code, interviewed developers individually, and built a new team. The project was finished in 3 months.

If you do not hold all of your own code, nothing else on this page can start.

At Company A, five engineers cost about $280 an hour combined, about $48K a month, to patch bugs and add features to the existing app while the lead engineer rebuilt it from scratch. The company was paying for both versions at once.

A rewrite brings its own costs. New features slow down or stop while the team rebuilds what already exists, the new version arrives with bugs of its own, and the team has to relearn every odd rule the old code quietly handled. That is the reason to put a number on staying put before you approve a rewrite.

Company D's AI features were built by a PhD graduate who was let go after a month for slow progress, then by a second engineer hired for the same work. Two weeks later he asked me to review his code. Nearly all of it had been written by AI, and features failed because neither AI engineer understood application architecture.

I rewrote 3 months of code in 4 weeks, spent a month training the engineer in application architecture, and wrote the team's coding practices and conventions into the AI agents' instruction files.

A public security record shows the same kind of gap in AI-built apps. The U.S. National Vulnerability Database lists CVE-2025-48757, rated 9.3 Critical, which describes an insufficient database access policy in apps generated on the Lovable platform. The supplier disputes the finding, saying each customer is responsible for protecting their own application's data.

Raymond Panko's review of fifteen years of spreadsheet research found that spreadsheet errors are common and non-trivial, and that so far only one method, inspecting the formulas cell by cell, has been shown to work. Excel also caps a worksheet at 1,048,576 rows by 16,384 columns, so a process that outgrows those limits has to be split across files by hand.

For software built on .NET, Microsoft ends free support and patches for .NET 8 and .NET 9 on November 10, 2026, as published in November 2026. Angular says its major versions are typically supported for 24 months. An old system is easier to move forward when you know which of those dates it sits behind.

A payments system, a health records system and a legal case system each hold data with its own rules. A rescue of any of them has to check more than whether the screens work: who can see each record, who can change it, and whether a trail of those changes exists.

OWASP, a nonprofit that publishes web security guidance, ranks broken access control first in its 2021 Top 10 and reports that 94% of the applications it tested had some form of it. My own security and compliance work includes HIPAA, SOC 2 and OAuth 2.0.

In Company A, the app was five Angular versions behind, and the team was writing Angular as if it were plain HTML, CSS and JavaScript, skipping the basics shown in Angular's own beginner example.

In Company B, both versions of the software had no proper application architecture, the plan for how the pieces fit together, so a second full build by a different team did not change the result.

In Company C, nobody on the five-person team really knew how to use Angular or .NET, and the team kept ignoring the design specifications.

In Company D, nearly all of the AI features had been written by AI tools, and the logic failed because neither AI engineer understood application architecture.

In Company E, the previous developer's download was missing pieces, and the only working piece of the product was a script that ran on a desktop.

1. Who writes the code? On many teams, the person who sells the project is not the person in your code. Ask to talk to the person who will be. With me, there is no account manager and no handoff.

2. What numbers can they show? Ask for a past engagement with a before and after, such as cost per month or months to finish. Every rescue on this page has one.

3. Who will own the code, hosting and accounts? They should be in your company's name from the first day.

4. Can they explain repair versus rebuild in plain words, with a number for each? If you hear only that the code is a mess, you do not yet have enough to decide.

I have built on .NET since 2009 and Angular since 2019, with 20+ production launches on teams of 2 to 60 engineers. You talk to me, not an account manager.