Building takes hours, not weeks
Claude Code, Cursor and similar tools write in an afternoon what used to take a sprint. Marketing, sales and founders now build their own tools. That is real progress.
Software and website maintenance on subscription
Building got cheap. Running it didn't.
With AI, an application can be built in an afternoon. After that it has to run for years: up to date, secure, documented and understood by someone. DevAbo handles maintenance, updates and security for your websites, WordPress sites and applications, whether your team, an agency or an AI wrote the code.
- Contract and project management in Mannheim
- Development by a dedicated team in Islamabad
- German law
Operations log
Example
- AlertPHP2Shell announced. Checked against your component inventory: 2 of 7 systems affected.
- To youFindings and plan sent. Patch approved.
- FixedOnline shop: PHP 8.3.35 → 8.3.36, tests passed.
- FixedCustomer portal: PHP 8.2.34 → 8.2.35, tests passed.
- CheckedAccess logs since 17 Oct show nothing unusual. Report sent to management.
Why now
Anyone can build software now. That doesn't mean anyone looks after it.
More is running than anyone can keep track of
Internal tools, automations, landing pages and interfaces to the shop or the ERP system are often already in production. Many process customer data, and for many nobody is officially responsible.
Vulnerabilities are found faster
Security researchers use AI too. OpenAI's “Patch the Planet” programme alone has reported hundreds of security issues in open-source software since June 2026. For every one of them, someone somewhere has to install an update.
One day building, five years running
Example: an application built with AI in one day and in use for five years. Building accounts for about 0.05 per cent of its lifetime.
What typically happens in those five years
- The PHP or Node version reaches end of life.
- A critical security vulnerability is published.
- A framework update breaks a feature.
- The payment provider changes its interface.
- The person who built it changes jobs.
- A customer asks which data is stored.
- A certificate or a domain expires.
- The hosting provider discontinues the plan.
October 2026
PHP2Shell: who knew on 21 October what they were running?
On 20 October 2026, two critical vulnerabilities in PHP were announced, CVE-2026-109618 and CVE-2026-109619. They affect versions 5.4 to 8.5 and can be exploited without logging in. PHP runs a large part of the web, from WordPress to the home-grown customer portal. Amazon dated a first attack attempt to 17 October, four days before the details were published.
Patches for PHP 8.2 to 8.5 arrived on 21 October. For 7.4, 8.0 and 8.1 there were only fixes in the source code and no ready-made packages, because these versions have reached end of life. Anyone who had put off updates was facing an emergency that day.
Three questions operators had to answer within hours
- Are we running PHP anywhere?
- Which version, on which server, with which hosting provider?
- Who installs the patch, and who checks afterwards whether someone had already got in?
If you don't know your systems, you can't answer any of them. The next vulnerability will be the same, just in different software.
With DevAbo, every system we look after has an inventory of all its components and versions. When a vulnerability becomes known, we check it against that inventory, get in touch with findings and a plan, and install the patch once you approve. Afterwards we check the logs and record everything in the system dossier.
Sources, as of 22 October 2026: Wikipedia, BleepingComputer, Qualys, OpenAI on “Patch the Planet”
Maintenance, updates, security
Writing code is no longer scarce. Responsibility is.
Software needs someone who understands it, documents it, maintains it, secures it and develops it further. This work never ends. That is why DevAbo is a subscription.
-
Understand
We get to grips with your code, even if nobody can explain it any more. AI tools help us work through unfamiliar codebases in days rather than weeks.
-
Document
Every system gets a system dossier: architecture, dependencies, data flows, where the credentials are kept and what to do in an emergency. It belongs to you and works for any other service provider too.
-
Update
We plan updates for WordPress and plugins, frameworks, libraries and PHP or Node versions before a version expires. In small steps, tested, with a way back prepared.
-
Secure
We continuously check new security advisories against your component inventory. Every change gets a code review and follows our standard with 20 checkpoints.
-
Build on
We develop new features with AI at the pace you are now used to. With review, tests and documentation, so the system stays understandable after the next feature too.
What changes day to day
Sooner or later something happens. Then it matters who is responsible.
| Situation | Without clear responsibility | With DevAbo |
|---|---|---|
| A critical security vulnerability is published. | You hear about it in the news or from your hosting provider. Then the search begins for credentials and for someone who has time. | We check the advisory against your component inventory, get in touch with findings and a plan, and patch once you approve. |
| The person who built the system has left. | The knowledge leaves with them, and often the credentials too. | Everything important is in the system dossier. At least two of our developers know every system. |
| An update breaks something. | The site is offline, and nobody knows which change caused it. | Updates run on a test environment first. The way back is prepared, and every change is logged. |
| Your team has used AI to build a tool that now processes customer data. | Typical weaknesses: API keys in the browser code, unchecked access to other people's records, no backups. | We review it against our standard, close the gaps and add it to our maintenance. |
| A customer or auditor asks which data the system stores. | Someone goes looking for the answer in the code. | The answer is in the system dossier, with data flows and storage locations. |
Who it's for
For everyone who has more software than people who understand it.
Companies with a grown system landscape
A website, a shop, a customer portal, an interface to the ERP system and a few automations. Each system was built by someone else, and none is properly documented.
Starting pointAssessment
Teams building with AI themselves
Marketing, sales or product teams build with Claude Code, Cursor or Lovable. We turn the result into something you can put in front of customers, and keep it that way.
Starting pointCode review and security fixes
Agencies
You deliver faster than ever and don't want to maintain every project yourself for years. We take over maintenance and updates, under your name if you wish.
Starting pointPartner call
IT departments with a hiring freeze
Your people should be working on the roadmap. We take over operations, updates and documentation for the systems that have to keep running alongside it.
Starting pointAssessment
Process
How we take over your software
-
Initial call
You tell us what you are running and what bothers you. We tell you honestly whether we are a good fit.
-
Assessment
A health and security check of your software: we record systems, components and versions, review everything against our standard and rank the risks by urgency. You receive your first system dossier and a fixed price for maintenance. The results are yours, even if you don't continue with us.
-
Takeover
Individual accounts with minimal permissions instead of shared passwords. We set up monitoring and backups and fix critical findings first.
-
Maintenance
Updates, ongoing checks of new security advisories, changes from your allowance and a monthly report that fits on one page. With a dedicated contact person in Mannheim.
Services
Three ways to work with DevAbo
You pay for maintenance, not for a full-time position. You get your quote at a fixed price before you decide.
One-off
Assessment
The health and security check for anyone who wants to know what they have first.
Fixed price, agreed in advance
- Map of all applications and interfaces
- Component inventory with versions and end-of-life dates
- Review against all 20 points of our standard
- Risks ranked by urgency, with effort estimates
- Final meeting and a quote for maintenance
Credited if you go on to book maintenance.
Monthly · Core service
Maintenance
For software that has to keep running.
Fixed monthly price
- Updates and security patches
- New security advisories checked continuously against your component inventory
- Monitoring and backups with restore tests
- System dossier, kept up to date
- Fixed monthly allowance for changes
- Agreed response time for critical vulnerabilities
- Monthly report and a dedicated contact person
Minimum term 6 months, then cancellable monthly.
Request an assessmentMonthly
Developer team
For ongoing development.
Monthly per developer
- Junior and senior developers, dedicated to your project
- Working with AI tools every day
- Review by a second developer for every change
- Project management from Mannheim
- Working directly in your Jira, GitHub, Slack or Teams
- Maintenance standard included
Minimum term 6 months, then cancellable monthly.
What determines the price: the number and type of systems, their condition when we take over, the response times you need and the change allowance.
How we work
Our developers work with AI. People carry the responsibility.
- AI helps us read
- We understand unfamiliar codebases faster because AI agents guide us through the code, explain how things fit together and write the first draft of the documentation.
- AI helps us write
- Tests, migrations and routine updates are created with AI support. That saves exactly the hours that used to make maintenance expensive.
- People decide
- A second developer reviews every change before it goes live. No AI agent gets write access to your production systems.
- Tools, not heroics
- Shared checklists, templates for the system dossier and automated dependency scans make sure every system is looked after equally well, no matter who is working on it.
That is how a small, dedicated team looks after many systems thoroughly. You get the care of your own developer without creating a position for it.
The DevAbo standard
20 checkpoints. For every takeover and every change.
We review against a fixed security standard with 20 points in five areas. It draws on the recommendations of OWASP, the international project for secure web applications, among other sources, and goes further on many points. The assessment rates every area as met, partly met or open and lists the specific findings.
In applications built with AI, we start with the areas marked with a star.
- Checked first in AI-built code
Access and secrets
Keys and passwords are kept only where they belong. Sign-in and sessions are secured.
- Checked first in AI-built code
Data and permissions
Everyone sees only the data they are allowed to see. Customers and tenants stay cleanly separated.
Inputs and interfaces
Whatever comes in from outside is checked before it is processed. Interfaces only hand out what is needed.
Operations and dependencies
Third-party libraries stay up to date and reviewed. Abuse is slowed down, and logs contain no sensitive data.
Checks before delivery
Before every go-live we check, automatically and by hand, that the standard is met, including from an attacker's point of view.
Your rating in detail
With the assessment you receive the rating of your system for each area, with the specific findings and the effort needed to fix them.
Request an assessment
Quick check
How well do you know your software?
Eight questions, two minutes. Your answers stay in your browser and are not transmitted.
“Don't know” counts as no. In an emergency it comes to the same thing.
Answer all eight questions and your result will appear here.
Team and locations
Mannheim and Islamabad. In the office, not working from home.
One contracting party in Germany
DevAbo is a brand of Y&L Solutions, based in Mannheim, Germany. German law applies, and the place of jurisdiction is Mannheim. Project management and coordination are in German or English; the developers work in English.
Working hours
Our team in Islamabad works from 12:00 to 21:00 local time. Pakistan does not change its clocks, so in Germany that is 9:00 to 18:00 in summer and 8:00 to 17:00 in winter.
Your team9:00–18:00
DevAboSummer 9:00–18:00
DevAboWinter 8:00–17:00
In Mannheim since 2019
Akan Yüzügüzel founded Y&L Solutions in Mannheim in 2019. DevAbo has existed since 2023. Interviews with him about DevAbo have appeared in brainGuide, business-on.de, Die Wirtschaft Köln and Onpulson, among others (in German).
Security in the Islamabad office
- Work happens only in the office; remote working is ruled out.
- Work devices belong to the office and never leave it.
- USB ports are blocked, and software is installed only after approval.
- Access to client projects only through a secured server.
- Connections to your systems are encrypted and require multi-factor authentication.
- Working hours recorded by fingerprint, with office management on site.
- Independent power supply in the office.
Data protection and liability
Data processing agreement with EU Standard Contractual Clauses, and liability insurance with Hiscox.
FAQ
What clients ask us first
Can't we just do this ourselves with Claude Code?
For prototypes and internal helpers: yes, and that's a good thing. But AI doesn't run operations. It won't get in touch when a vulnerability is published overnight, it isn't liable for anything, and it doesn't know what was changed last year and why if nobody wrote it down. We take on that role, happily alongside your team, which keeps building.
Do you take over software that someone else built?
Yes, that is our core business. Agency, freelancer, in-house team or AI: we start with the assessment and document the current state before we change anything.
Which technologies do you support?
Most of what runs in mid-sized companies: PHP with WordPress, Laravel, Symfony and Shopware, JavaScript and TypeScript with Node.js, React, Vue and Angular, as well as Python, Java, C# and .NET, mobile apps and databases such as MySQL and PostgreSQL. If there is something we are not good at, we will tell you in the initial call.
What belongs in a maintenance contract for software or WordPress?
With us it includes regular updates of WordPress, plugins, frameworks and server software, ongoing checks of new security advisories with patches within the agreed response time, monitoring and backups with restore tests, an up-to-date system dossier, a fixed allowance for small changes and a monthly report. What happens at the end matters too: the system dossier and the credentials belong to you.
How much does it cost to maintain a website or WordPress site?
That depends on the number of systems, their condition and the response times you need. A single WordPress site that is kept up to date costs considerably less than a shop with interfaces to an ERP system. After the assessment you get a fixed monthly price.
What happens with the next big vulnerability?
We check it against the component inventories of all systems we look after and get in touch before you have to ask: whether you are affected, what we propose and when we will do it. We install critical patches within the agreed response time.
Who has access to our systems?
Only the developers who look after your system, each with their own account and the minimum permissions needed. You grant and revoke access yourself. We never exchange passwords by chat or email.
Where are the developers based, and which language do we work in?
Contract and project management are in Mannheim, development takes place in the Islamabad office. We speak German or English with you; the developers work in English.
How long does a contract run?
The assessment is a one-off engagement. Maintenance and developer teams have a minimum term of six months and can then be cancelled monthly. You receive our terms and conditions with every quote.
What happens if we cancel?
You receive the complete system dossier, all your credentials back and, if you wish, an orderly handover to your team or another service provider. Code and rights of use are yours once paid in full.
How do you handle data protection?
We sign a data processing agreement. Because development takes place in Pakistan, the EU Standard Contractual Clauses apply as well. Wherever possible, we work with test data rather than real customer data.
Can we also get a developer team?
Yes. If you are looking for dedicated developers for your product, you get them from us as a developer team on subscription, with the same standard as our system maintenance.
Contact
Tell us what you're running.
We will get back to you within one business day (Mon–Fri) and tell you openly whether and how we can help.
Urgent security incident?
Call us directly, around the clock. Monday to Friday from 8:00 to 18:00 (German time) we usually get back to you within 15 minutes, at other times within one hour, including nights, weekends and public holidays.
- info@dev-abo.de
- Emergency
- +49 173 4250811
- Address
- DevAbo · Y&L Solutions
Rahnfelsstraße 10
68163 Mannheim
Germany