14

We recently discovered a bug in our payment gateway software. The amount of the transaction passed on to the client is less than the actual amount. The last time this piece of code was modified was 5 years ago. Since the payment gateway supports several other payment options, and the amounts lost were small, this didn't draw attention until recently.

The company has a tradition: whenever a developer resigns, he/she puts something bizarre (such as a silly comment or an easter egg) into the code. This tradition has generated some funny moments among colleagues. It is possible that a developer introduced this bug deliberately as part of this tradition, but we are not sure. Nobody who was with the team back then is working here now. Moreover, our company has a policy of deleting or anonymizing records of past employees, so we cannot be sure who introduced the bug.

How should we professionally handle this situation, and limit damages in the next meeting with the client? Is it professional/ethical to disclose that this "tradition" might have been responsible for this bug?

27

Pass this off as "this bug was introduced by a former employee"

Log the bug, get it fixed, get it tested and deploy it. Then move on with things.

That's all you can do really. If you want to continue this practice going forward, then all future easter eggs should be approved by the Team Lead to make sure that these "loose cannon" changes don't affect the build or end-user functionality.

Let your manager decide how the fallout from this previous (and costly) change should be managed (communication/compensation/data fixes/legal action/whatever).

If this practice is common knowledge, then it's your TL's role to ensure that whatever is inserted isn't damaging in nature (intentional or otherwise).

| improve this answer | |
11
  • The last time the piece of code involved was modified is more than 5 years ago
  • company policy is to complete delete or anonymize all previous employees records

I'm assuming that 1) a colleague has left recently, 2) you saw a recent commit to the old codebase by anonF35te3S99, which is not related to a known issue, and 3) assumed it's a former colleague playing a farewell prank.

First of all there's a difference between leaving a silly comment, a silly log message, and causing loss of income in this way. 1.2% compounds fast over time even for small transactions. You should mention that to your boss and maybe call the former developer to get an idea why he made those changes.


In the long run, consider buffing up your deployment / testing infrastructure to catch these sorts of things before they make it to production. As an engineer this wasn't a prank, it was a reminder that a critical assumption goes untested in the bit of code that handles money. That's important stuff. Avoiding such embarrassments in the future will be a strong incentive to get the resources you need, if any are needed.

| improve this answer | |
7

Full disclosure would damage your relationship with the client, probably permanently (you would lose them).

A "tradition" where someone can deliberately put flaws in what you deliver to the client is idiotic and intolerable, and would likely get your company a (deserved) terrible reputation with your market.

All you can do is to say that you have discovered a bug, it has these effects, here is the plan and timetable to fix it, here is what you will do to make things right (if possible).

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged .