Triage

Required

• Take control of every account before touching the code

  TKO-1

  Before the first change, list every account the product depends on. Give the company at least two admins on each, and remove every person who has left.

• Rotate every secret the previous team could read

  TKO-2

  Replace every API key, database password, signing key and token that existed before the handover. Revoke the old values, so they stop working.

• Take a backup and restore it before the first change

  TKO-3

  Before the first change to inherited code or data, take a full backup of every data store and restore it on a separate machine.

Recommended

• Run it from a clean checkout

  TKO-4

  Make the inherited code build, run and pass its own tests on a clean machine, using only the repository and the secrets store.

• Map the system before changing it

  TKO-5

  Write one map of the system that lists every service, data store, scheduled job, outside service, setting and place it runs. Keep it in the repository.

• Measure a baseline before the first fix

  TKO-6

  In the first week, record the starting numbers in a dated file. Every later report states its numbers against them.

• Fix in risk order

  TKO-7

  Work through an inherited codebase in a fixed order. Finish each step before structural changes start.