- Inherited a PHP app with no documentation.
- Found a SQL injection and fixed it quietly.
- Upgraded an app across PHP versions and survived the deprecation warnings.
- Moved a site between servers without losing data.
- Explained to a business owner why "just one small change" wasn't small.
Three or more? You're a rescue developer already. This page is a self-interview — the questions you'd ask yourself — answered in short field notes.
"Most AI-built apps aren't PHP. Does that rule me out?"
No. Tools like Lovable and v0 mostly generate JavaScript/TypeScript apps with services like Supabase (our observation). But the problems are the ones you know: data access, secrets, auth, payments, deploys. You'll read some TypeScript. You already read code you didn't write — that's the skill.
"What's the PHP-native version of this work?"
Old PHP apps need rescue too. PHP's own policy gives each version two years of active support and two years of security fixes, then end of life. Plenty of businesses run apps on versions past that. An upgrade plan plus security review is a natural rescue offer for you — no new language required.
"How much JavaScript do I want to learn?"
Start wherever is comfortable.
Same Bug, Two Decades
Two code panels side by side. Left: a 2009-style PHP script with $_GET['id'] dropped straight into a query. Right: a freshly AI-generated app where the database has no access rules, so any user can read any row. Tap the line in each that causes the leak. Then the page shows both fixes — prepared statements on the left, a row-level security policy on the right — and one sentence: "Different decade, same lesson. You learned it first."
Same Bug, Two Decades
"What do I check first on an AI-built app?"
Field notes, in order:
- Secrets in front-end code (service keys, API (application programming interface) keys). Rotate and move server-side.
- Database access rules (Supabase row-level security).
- Auth: password reset, email verification, account deletion.
- Payments confirmed server-side via webhooks.
- Error tracking — Sentry's Developer plan is free.
- One end-to-end test — Playwright is free and open source.
- Free-tier limits — Supabase free projects pause after a week idle; Pro is paid.
- Git history and backups.
"What tools should I practise with?" (verified 23 Oct 2026)
Lovable (free: 5 build credits/day, up to 30/month) and v0 (free plan) to generate test apps. Cursor (free plan) to read and edit them. Supabase free tier (500 MB database, 2 projects). Vercel Hobby to deploy. Bolt.new is common too — we couldn't confirm its current limits. No certificate needed.
"What does a legacy health-check actually include?"
A short, fixed-scope review you can offer old PHP clients:
- Which PHP version it runs on, and whether that version still gets security fixes.
- Framework and package versions (Composer
outdatedis a good start). - Obvious risks: raw queries, file uploads without checks, admin panels without rate limits.
- Backups: do they exist, and has anyone ever restored one?
- A ranked list: fix now, plan this quarter, can wait. Deliver it as a two-page note in plain language. Many owners have never had one, and it often leads to upgrade work.
"How do I talk to founders?"
Lead with what works. Explain each risk in one plain sentence. Give a fixed-price triage first, then a scoped fix list. Don't criticise the tool they used — it got them here.
"Where would the work come from?"
Two pools. Founders (mostly global; "ai mvp development" gets 480 searches/month in the US vs 50 in India): Indie Hackers, Wellfound, Cutshort, local startup meetups. Old PHP clients (very India-friendly): businesses you or your agency built for years ago, now on unsupported PHP. A polite "here's an upgrade health-check" message is often welcome.
"What does my profile say now?"
Before: "Senior PHP Developer · Laravel · CodeIgniter" After: "PHP developer who rescues apps — legacy PHP upgrades and AI-built MVPs made safe to launch"
Your realistic 90 days
You've maintained PHP code that other people wrote in a hurry — no tests, no docs, deadlines everywhere. AI-built MVPs are the new hurried code. You'll reuse your instinct for reading unfamiliar code fast, and learn the JavaScript-side tooling as you go.
Assumes 2–3 hours a day alongside job applications, a laptop and a phone, and free plans only. Every step has a smaller version and a way to pause. Use them. It runs in three blocks of 30 days, each ending with a signal that you're on track. A signal is not a promise of a job or income.
What AI changed in your old tasks
| You used to… | Now you… |
|---|---|
| Read unfamiliar Laravel controllers to find the bug | Read unfamiliar Next.js routes and Supabase calls the same way |
| Fixed .env and config mismatches between servers | Fix Vercel environment variables and auth redirect URLs |
| Added the first tests to an untested PHP app | Add the first Playwright smoke test to an untested AI-built app |
Your first 7 days
| Day | Task | Done when |
|---|---|---|
| 1 | Write 3 legacy-PHP rescue stories: what was broken, how you found it | 3 stories, 5 lines each |
| 2 | Generate a small app in Lovable or v0 with login and a form | Preview works |
| 3 | Export to GitHub and deploy on Vercel Hobby | Live URL |
| 4 | Read the generated code for 1 hour and list what confuses you | A list of 10 questions |
| 5 | Answer 5 of them from the docs (Next.js, Supabase) | 5 answers noted |
| 6 | Write one Playwright test that logs in and submits the form | Test passes locally |
| 7 | Find 5 founders asking for help with AI-built apps | 5 links saved |
Days 1–30: Read it, test it, report it
| Step | Time | Done when | Smaller version | If you need to pause |
|---|---|---|---|---|
| Write a triage report on your own app: 3 risks, 3 fixes, 1 Playwright test | about 10 hours over 2 weeks | report + passing test on GitHub | Report without the test. | Commit and pause. |
| Offer 2 founders a free 45-minute code read with a written report | about 5 hours | 1–2 reports delivered | 1 founder. | Pause new offers. |
Signal by day 30: One founder has read your triage report and replied.
Days 31–60: A second stack
| Step | Time | Done when | Smaller version | If you need to pause |
|---|---|---|---|---|
| Rescue a second app built differently (Cursor-written Express API, or a Laravel app with AI features) | about 10 hours | second report with before/after | Extend the first rescue. | Stop after the report. |
| Apply to 8 roles: maintenance developer, full-stack support, PHP + Next.js | about 4 hours | 8 logged | Apply to 4 roles: maintenance developer, full-stack support, PHP + Next.js. | Stop sending for now. Keep a list of who you've contacted so you can follow up later without doubling up. |
Signal by day 60: A founder asks about paid help, or you reach an interview for a support/maintenance role.
Days 61–90: Fixed-scope work
| Step | Time | Done when | Smaller version | If you need to pause |
|---|---|---|---|---|
| Deliver one fixed-scope rescue (triage + top 3 fixes) with written sign-off | about 12 hours | sign-off received | A free rescue with a testimonial. | Finish the current fix only. |
| Publish an anonymised rescue write-up and share it with 10 founders or agencies | about 3 hours | post up, 10 messages | 5 messages. | Put it on hold until your current interviews are done, then come back to it. |
Signal by day 90: A paid fixed-scope rescue or a second-round interview.
The two worries we hear most about this move
The apps I'd rescue aren't in PHP. Does that matter? Many are in JavaScript with Supabase or Firebase, so you'll learn some new tools. But the problems (SQL injection, missing access rules, no backups) are ones PHP developers have fixed for years. Lead with that. How do I avoid endless unpaid 'just one fix' work? Offer a fixed-scope review with a written report first, then quote the fixes separately. Write down what's in and out of scope before you start.
Other worries, such as age, a career gap, no degree, English, family pressure and savings, are covered on the route page and the role page.
One search that fits your background
The full set of search strings for this move is on the route page. They work on LinkedIn, Naukri and foundit; Instahyre and Cutshort are worth a weekly look too. Add your old job title to any of them with AND, so recruiters who want both skills find you first.
Job-hunt moves that matter for this route
- Indie Hackers, LinkedIn and X are where founders post 'my AI-built app broke'.
- Many Indian agencies still need PHP + modern JS people. Say you do both.
- Get repo access via the founder's GitHub invite; never accept passwords over chat.
Your 30/60/90 quests
XP: learning 20 · proof 60 · outreach 40. Ranks: Wayfinder → Builder → Pathmaker. Progress stays in your browser only.
"What's hard about this?"
Scope creep. Unrecoverable code (say so early). Founders under money pressure. Real user data — treat it carefully; not legal advice.
"Which offers should I avoid?"
Unpaid "trial tasks" that are the whole job, paid lead lists, deposit-asking job posts, and anyone requesting OTPs or UPI PINs. Official domains only. Report: cybercrime.gov.in / 1930 or ReportFraud.ftc.gov.
"Any last questions for myself?"
Do I need to become a TypeScript expert? Reading level first; writing grows with projects. Is legacy PHP work a dead end? It's steady, unglamorous and needed. Combining it with AI-app rescue is a distinctive offer. What if I fail the first rescue? Write down what you learned. That report is still proof.
Rescue route · PHP hub · siblings: automation, chatbots · same route from WordPress, Web
Pay
We haven't verified pay data for this route. Check current listings on job boards in your city and ask people already in the role.
Quick quiz: does this path fit?
Answer each, then press Check. Every answer explains itself.
Make your Path Card
A shareable reminder of where you're heading. The day count starts the first time you open this page; quest XP comes from your log above.
Scam check before you apply anywhere
- Real job and gig platforms are free to join. Never pay a "joining" or "training" fee.
- Never share an OTP or UPI PIN — no genuine employer needs them.
- Use official domains only; type the address yourself.
- India: report at cybercrime.gov.in or call 1930.
- US: report at ReportFraud.ftc.gov.
Small steps, every day.
Each quest has a smaller version for hard weeks, and a pause button. Nothing is lost.
Keep exploring
Sources
Checked between 23 Oct 2026 and 25 Oct 2026. We opened every link below ourselves. Search volumes on this site come from OpenSEO keyword research (Oct 2026).
The other facts here are shared with the route page, where each is listed in full with its link.
| What we checked | Where |
|---|---|
| Lovable / v0 / Vercel / Cursor plans | lovable.dev · v0.app · vercel.com · cursor.com |
| PHP support policy | php.net |