Feels like you should start with introducing version control, dependency management, and creating a deploy process after that. Those seem like low hanging frui

Feels like you should start with introducing version control, dependency management, and creating a deploy process after that. Those seem like low hanging fruit that are unlikely to effect prod. You should also probably spend a decent amount of time convincing management of the situation. If they're oblivious that's never going to go well. I agree a full rewrite is a mistake and you have to instead fixed bite sized chunks. It also will help to do that if you start to invest in tooling, a deploy story and eventually tests (I'm assuming there are none). If I was making 20 million off some code I'd sure as heck prioritize testing stuff (at least laying the groundwork). Its probably also worth determining how risk tolerant the product is and you could probably move faster cleaning up if it is something that can accept risk. If it's super critical and I'd seriously prioritize setting up regression testing in some form first