14

We recently discovered a bug in our payment gateway software. The amount of the transaction passed on to the client is less than the actual amount. The last time this piece of code was modified was 5 years ago. Since the payment gateway supports several other payment options, and the amounts lost were small, this didn't draw attention until recently.

The company has a tradition: whenever a developer resigns, he/she puts something bizarre (such as a silly comment or an easter egg) into the code. This tradition has generated some funny moments among colleagues. It is possible that a developer introduced this bug deliberately as part of this tradition, but we are not sure. Nobody who was with the team back then is working here now. Moreover, our company has a policy of deleting or anonymizing records of past employees, so we cannot be sure who introduced the bug.

How should we professionally handle this situation, and limit damages in the next meeting with the client? Is it professional/ethical to disclose that this "tradition" might have been responsible for this bug?

closed as off-topic by gnat, Blrfl, scaaahu, Masked Man Jul 5 '18 at 13:54

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions seeking advice on company-specific regulations, agreements, or policies should be directed to your manager or HR department. Questions that address only a specific company or position are of limited use to future visitors. Questions seeking legal advice should be directed to legal professionals. For more information, click here." – Masked Man
If this question can be reworded to fit the rules in the help center, please edit the question.

27

Pass this off as "this bug was introduced by a former employee"

Log the bug, get it fixed, get it tested and deploy it. Then move on with things.

That's all you can do really. If you want to continue this practice going forward, then all future easter eggs should be approved by the Team Lead to make sure that these "loose cannon" changes don't affect the build or end-user functionality.

Let your manager decide how the fallout from this previous (and costly) change should be managed (communication/compensation/data fixes/legal action/whatever).

If this practice is common knowledge, then it's your TL's role to ensure that whatever is inserted isn't damaging in nature (intentional or otherwise).

11
  • The last time the piece of code involved was modified is more than 5 years ago
  • company policy is to complete delete or anonymize all previous employees records

I'm assuming that 1) a colleague has left recently, 2) you saw a recent commit to the old codebase by anonF35te3S99, which is not related to a known issue, and 3) assumed it's a former colleague playing a farewell prank.

First of all there's a difference between leaving a silly comment, a silly log message, and causing loss of income in this way. 1.2% compounds fast over time even for small transactions. You should mention that to your boss and maybe call the former developer to get an idea why he made those changes.


In the long run, consider buffing up your deployment / testing infrastructure to catch these sorts of things before they make it to production. As an engineer this wasn't a prank, it was a reminder that a critical assumption goes untested in the bit of code that handles money. That's important stuff. Avoiding such embarrassments in the future will be a strong incentive to get the resources you need, if any are needed.

7

Full disclosure would damage your relationship with the client, probably permanently (you would lose them).

A "tradition" where someone can deliberately put flaws in what you deliver to the client is idiotic and intolerable, and would likely get your company a (deserved) terrible reputation with your market.

All you can do is to say that you have discovered a bug, it has these effects, here is the plan and timetable to fix it, here is what you will do to make things right (if possible).

Not the answer you're looking for? Browse other questions tagged or ask your own question.