107

I obtained an interview with the development team leader and CEO of a startup company. At the end of the interview, the development team leader asked me to send him an email with websites' links to some of my previous projects, which I did.

They seem like they're thinking to move forward with me in that position.

Today, I received a feedback from him for my previous email telling me that he found some form validations issues with 2 of my projects, asking me if he could have access to the back-end of one of my websites/web applications (which I developed for my current employer) as that may give him better insights into my skill.

I can provide him with credentials for one of my projects, but I don't think this is a professional move to make. Neither is his request. No one has requested this before.

I'm thinking about replying with a polite negative answer, without explaining why. And telling him that I'm open for any kind of test, case study, or even an IQ test. Or doing another interview via Skype, so I can talk even deeper about my projects and some databases structures.

I could make a Skype shared session with me taking control and browsing one of the back-ends, but I don't think this is a good idea.

I really want this job and appreciate your help.

Update

I made it clear to the interviewer that these are not my personal projects: that I developed them but do not own them.

Important Edit

I'm not tending to give the credentials to anybody. I use my github profile to show my coding skills, because I own them 100%.

I'm totally aware of the ethical and legal stuff. I will not betray my current employer ever. And I never did. Please stop questioning My Personal Ethics.

Improve this question
10
  • 3
    Comments are not for extended discussion; this conversation has been moved to chat.
    – user44108
    Jul 26, 2018 at 7:07
  • 2
    "asking me if he could have access to the back-end of one of my websites/web applications" - To clarify; did they mean access to your account on those applications, or did they want an account of their own?
    – marcelm
    Jul 26, 2018 at 12:28
  • 2
    FYI: Using IQ testing for hiring decisions is illegal, and even if it wasn't, it'd be a really shitty metric to go by.
    – Alexander
    Jul 27, 2018 at 21:50
  • Do not work for them - they are doing dodgy stuff.
    – Ed Heal
    Jul 29, 2018 at 18:32
  • @Alexander Could you tell us why?
    – MAZux
    Jul 29, 2018 at 19:37

9 Answers 9

Reset to default
284

Don't do it. Not by giving access, not by screen sharing, not even by describing what is inside (like what security algorithms).

Your job as software developer is to create safe and secure environment for your customer (here: current employer). Not only such action violates the basics of the good code of conduct, but you will almost certainly be infringing on clauses of your employment, Non-Disclosure Agreement, and possibly some laws in your country (as in right to fair competition, keeping trade secrets and such).

Even sharing the links can possibly mean some security issues if third party will attempt any form of unauthorized access.

Proper answer to such request is: Unfortunately I have to decline your request, as it would violate the company policy.

I hope it is only a test to see if you understand the importance of confidentiality.

Improve this answer
8
  • Comments are not for extended discussion; this conversation has been moved to chat.
    – Masked Man
    Jul 27, 2018 at 3:50
  • 11
    You might add the strategy of turning it around: "How would you feel about it if, after working here a while, I were to get the same request from a future employer? Would you be comfortable with me granting them access to your code or systems here?"
    – user1602
    Jul 27, 2018 at 13:23
  • 1
    It depends on one's tone of voice. Obviously asking it sarcastically wouldn't get a good reception. It's possible to ask this question in a polite and nonconfrontational way.
    – user1602
    Jul 29, 2018 at 11:39
  • 1
    @gnasher729, I disagree. Saying that would suggest that the OP doesn't even realize that the request is completely inappropriate.
    – user1602
    Jul 29, 2018 at 20:10
  • 1
    Though it is not asked in a question it still worth to mention that most likely on receiving such suspicious request employee is obligated to report this incident to associated employer(s) since he might be only one among many (ex-)employees who went through social engineering if it actually took a place.
    – ony
    Jul 25, 2019 at 21:03
155

Refuse

Refuse to grant access to this person. You're not authorized to do that, and they aren't authorized to access the system. Asking for access to your current employer's system is immensely unethical and will endanger your current employment at best. What happens if they steal user data or secret keys? Or what if they install a back door? Or what if they exploit a vulnerability? If they do, you're responsible for letting them in. Anyone with a shred of decency would not put you in a position where a successful attack could be blamed on you because you granted unauthorized access. I'm not entirely clear on whether being responsible for such a breach might expose you to criminal charges or liability in any countries, but the risk to you is bad enough even if it's not.

The job may not even be real

There's a possibility that there is no job and this person is an actual attacker trying to break into your current employer's web site and steal information. Under no circumstances should you put yourself in a position where you might have aided an attacker.

Withdraw your application

Someone who asks you to do something this blatantly unethical before you work for them will not treat you better once you're hired. This may be from severe ignorance of normal security practices or it may be from malicious intent; it does not really matter which. Either way, you are likely to be asked to do more unethical and potentially illegal things once you become their subordinate. You don't want to put yourself in a position where you're faced with the choice of possibly losing your job or doing something unethical, so don't take the risk of working for this person.

Bottom line: Don't walk. RUN.

The red flags here are staggering. Stop dealing with this person immediately.

Don't worry about being too polite. Just don't be rude. Here's some potential phrasing, although I don't know how helpful this is given you're in Syria:

I am not authorized to grant you this access. Thank you for considering me, but I must withdraw my application at this time.

Improve this answer
9
  • 21
    (2) is a little harsh, considering the possibility of miscommunication. It's possible the potential employer did not realize these were work projects instead of side projects. It's also far more likely that a startup founder would be inexperienced than intentionally unethical --- they'd need some experience even to know how to win unethically.
    – employee-X
    Jul 25, 2018 at 14:30
  • 10
    @employee-X It sounded pretty clear to me. He wants access to the backend for an official company product, which contains (almost tautologically) an extremely significant portion of the code, and likely all of the customer data. If that was a miscommunication, it's such a big one that it would probably itself be a reason to follow the steps outlined in this answer -- do you want to work for a PHB who "miscommunicates" illegal objectives?
    – anon
    Jul 25, 2018 at 16:36
  • 5
    @employee-X, in comments the OP stated that it was clear this was a work project, and not a side project. As a result, this is the only proper answer.
    – Conor Mancone
    Jul 25, 2018 at 16:36
  • 7
    @MaskedMan The headers provide appropriate section division and a built in TL;DR mechanism. They aid enormously in guiding the reader through the logic. With them, even a 5 second skim will allow a reader to understand the main points. A list is inappropriate here, as I'm not enumerating a group of items in a category or providing a sequence of any kind (which is why I removed the numbering).
    – jpmc26
    Jul 26, 2018 at 4:05
  • 2
    @jpmc26 Ok, that sounds reasonable. Would you consider changing them from h1 to h2? I think your answer is very well written and useful, I am just concerned that the huge text could be a bit detracting from the rest of the useful advice. Naturally, I would like more people to read your complete answer, not just look at the headers and scroll down (which is what I did the first time, to be honest).
    – Masked Man
    Jul 26, 2018 at 4:13
39

In one of your comments you say:

I hadn't asked to share code, I got asked to give them credential to websites I worked on. I've seen the job's advertisement on their website so I went to their company.

This is a red flag, full stop.

If you have never been to the finance stack exchange, many of the questions asking whether or not something is a scam include the fact that someone has asked for credentials to a personal account banking or otherwise. One of the chief rules in IT security is that you never share credentials with someone.

If you provide credentials to someone, they are, for all intents and purposes, you. Every action they take is tied to you. Every file they delete is done by you. Every bit of personal data that they scrape is on your head.

So, to be plain: no matter how much you want this job, if you have to provide secured access to get it, it isn’t worth it and you should worry about a company that would casually ask for secured access to systems like this.

Improve this answer
2
  • "Credentials" doesn't necessarily mean his credentials. It's possible that they just want an account on the OPs website to play with it, for that they would also need credentials, to their own account. The OPs question and comments are ambiguous as to which of these two situations applies, so you should be careful about jumping to conclusions.
    – marcelm
    Jul 26, 2018 at 12:28
  • 3
    @marcelm If you as an administrator create an unauthorized account, the actions of the account are also, effectively, you.
    – Tal
    Jul 26, 2018 at 13:55
25

Based on comments seems that "These projects I made for my current company I'm workin for right now."

If that is the case then definitely DO NOT share the back-end with them. Even more, I'd say you may be already in trouble if you sent this person some other part of the code for them to evaluate; company code is their property (although you programmed it), and sharing it is usually not encouraged or permitted (your contract surely restricts it).

I suggest you reply back saying that you are not able to share such thing, as it may get you into (more) trouble, and that you are willing to discuss about Form Validation by any other means (perhaps, Skype like you mentioned).

Edit: Seems that you shared the links to the websites, and not some code. This is less serious than having shared the code, but still having access to the link can be the doorway for many analysis and inspections that can still reveal many things about the nature of the webpage (the 'inspect element' tool, for starters).

I say now that having shared that is not as serious, but still I would not take that for granted. The best you can do now is not to share them the back-end, and hope sharing those links won't affect you.

Improve this answer
0
20

I've been in your situation, several times.

Some companies ask this to gauge your response. If you accept the request, you're a security risk for them and they're going to instantly reject your application. They're the good companies.

Others see nothing wrong with others sharing previous work with them that they don't have rights to. Got to wonder what other things they do that aren't legal or ethical.

If the first, sternly but politely declining the request will put you in good standing with them, making it more likely you'll be hired.

If the second, you don't want to work there anyway so getting rejected for declining is actually a good thing.

What's more usual these days to get an impression of your coding style is asking for open source work you've participated in. Having a small repository on say github with a few hobby projects can be a good entry point for that, just make sure the code you place there is high quality.

Improve this answer
5
  • I would also thank him for the free debug asking for details in order to fix the issues
    – Paolo
    Jul 25, 2018 at 8:52
  • 8
    I would be just as wary of a company that "tests" me by asking me to do something unethical / illegal as I would a company that really wants to hack into my previous employer. Both of these are danger signs of companies that you don't want to work for.
    – DaveG
    Jul 25, 2018 at 18:04
  • 3
    @DaveG or it is simply fake company with the business idea to acquire leverage on inexperienced people just about to enter work force.
    – mathreadler
    Jul 25, 2018 at 20:30
  • 1
    In general, a good test is one that doesn't make the tester look bad. In this hypothetical example, an ideal job candidate may cease all further communication with the company, and report them to whatever agency may be relevant. So, the company would lose their best candidates and be under suspicion. It's a bit like separating the good apples from the bad apples by smashing them all into pulps. In the end, you'll have no apples at all.
    – user3685427
    Jul 29, 2018 at 0:28
  • @DaveG the few times I've had this happen it was HR flunkies asking it, not IT people. They were probably thinking they were doing their dev leads a favour or the dev leads has asked for some "prior work" and the HR department misinterpreted that as work done for a prior employer. If I'd thought this was a serious attempt at a security breach at a previous employer I'd have alerted that previous employer instantly about the security incident, obviously.
    – jwenting
    Jul 30, 2018 at 8:32
19

If your current employer is the US government/military or a contractor thereof, you may be required to report this as an attempt to gain unauthorized access:

If you have a clearance, DoD 5220.22-M details certain events which you are required to report:

b. Suspicious Contacts. Contractors shall report efforts by any individual, regardless of nationality, to obtain illegal or unauthorized access to classified information or to compromise a cleared employee.

Even if you aren't required, the Pentagon is interested in reports of industrial espionage within defense contractors:

Dan Payne, director of the Defense Security Service, an agency that oversees industrial security, said suppliers are stepping up voluntary reporting on suspected spying. [In 2015] contractors shared 47,000 “suspicious contacts” with individuals or companies seeking access to products or information, compared to just 5,000 suspicious contacts reported in 2009, he said.

While in all likelihood the request is benign (in which case you still shouldn't give them access), it's worth pointing out, depending on the product, this may be much more serious.

Improve this answer
6
  • 1
    If OP is the US government or a US government contractor, then the appropriate remedy may be a FOIA request. In general, code is not classified and requests for code are not attempts to compromise a cleared employee. Regardless, if the government wishes to assert otherwise then they will do so in their FOIA response. You can confidently share your FOIA response with anyone.
    – emory
    Jul 26, 2018 at 16:00
  • Government contractors are private businesses and as such aren't subject to FOIA requests (with some very limited exceptions for government documents held). Additionally, there is an exemption from FOIA for "trade secrets and commercial or financial information obtained from a person [that is] privileged or confidential." Ultimately, even if the FOIA applies, the person seeking the information has just as much right to the disclosure as the employee, therefore they don't need someone on the inside to help.
    – TemporalWolf
    Jul 26, 2018 at 17:38
  • 2
    Either the code belongs to the government (in which case it is foiable) or it belongs to the contracting company (in which case it is not classified). I agree the person seeking the information has just as much right as the OP. In fact, the OP could suggest they write their own FOIA request.
    – emory
    Jul 26, 2018 at 21:38
  • This is not for the OP but for any government worker who implemented something they are proud of. FOIA your contribution. You can freely share the foia response.
    – emory
    Aug 9, 2018 at 10:53
  • 1
    i did not know that. OTH if anyone ever wrote anything good about your work in an email, report, etc then FOIA that and disseminate liberally.
    – emory
    Aug 9, 2018 at 19:03
0

Major scandals have begun this way. Enron didn't begin with the bosses asking the entire accounting department to blatantly cook the books; it began with a seemingly innocent favor, a boss asking someone to manipulate one number for the short term. And eventually that blossomed into full department fraud. In your case, you're first loaning credentials or skyping the backend, then with that over your head you're bringing files off campus, then you're planting keyloggers and viruses and facing 10-15 years in club FED.

Reputable employers will respect intellectual property rights and not ask you to engage in what could be considered corporate espionage. I would hope this is a test and when you respectfully decline they will infer you would do the same for them or at least understand. You said this is in another country and the prospective employer may also have a different culture of confidentiality than your current employer.

I would use direct language and not be too soft or aggressive (i.e. don't preface with "unfortunately" or some other "but for" term). Just say you are "not at liberty to..." or "I am not able to disclose.." or some similar form of that.

If they respond negatively then it's not likely a job you want or should take.

Improve this answer
4
  • 12
    i'm not overly familiar with Enron's debacle, but I was unaware it had anything to do with IT security credentials. I thought it had to do with wide-spread, systematic management-approved accounting fraud.
    – bharal
    Jul 25, 2018 at 8:48
  • 1
    @bharal yes, it did. Not sure about their IT security, but there have been cases where a vulnerable IT infrastructure caused data to get out of an environment that brought to light such systemic fraud. Think the climategate email scandal
    – jwenting
    Jul 25, 2018 at 9:03
  • 4
    @bharal I'll clairfy Enron wasn't about IT security, it was a small fraud that lead to a large fraud. Basically the frog in boiling water analogy. The accountants didn't go to work one day with management asking a whole floor to blatenly cook the books. It starts with a seemingly innocent favor, your boss asking you to manipulate one number for the short term. That is the beggining that blossums into full department fraud.
    – A.K.
    Jul 25, 2018 at 11:53
  • 1
    @A.K. that's how it goes. My dad was a certified accountant qualified to sign off company books for tax purposes. He mentioned more than once how companies tried to trick him into signing off on cooked books, or openly asked them to do so. He never did so, and always reported such customers to his employer's legal department.
    – jwenting
    Jul 30, 2018 at 8:35
-2

It's perfectly reasonable for an employer to learn as much as they can about a candidate's capabilities with respect to an employment opportunity. It can be difficult for a hiring manager to make such an assessment, especially for jobs in software development. That said, asking for credentials to poke around in the name of assessing your skills is wrong.

As a member of a development team, you do not own the code you have worked on - your employer does. They, and only they, have the rightful authority to decide who gets to work on it, or even look at it. The credentials you were asked to provide are also not yours to give out. You were trusted by your employer to work on their intellectual property and work with their site. To share your credentials to that site with anyone is at best a betrayal of that trust, surely grounds for dismissal, and at worst grounds for a lawsuit.

As was stated in other answers, simply making the request of you is a breach of business ethics and doesn't bode well as a genuine employment opportunity.

As you pointed out in your question, there are many other more reasonable options available to this employer to assess your skills, if that is even what this is all about.

How to turn down the request? Simple. "I'm not permitted to share my credentials with anyone." If they will accept no other alternative, it could very well be a social engineering attack against your current employer disguised as a job opportunity.

Improve this answer
1
  • 1
    I will not betray my current employer, and I never did. I'm not welling to share the credentials with anybody. I'm not asking if I should neither. I'm just asking about how to refuse it, because I think it may be a test for my confidentiality.
    – MAZux
    Jul 29, 2018 at 19:37
-14

Any software developer worth their salt will have examples of their work that they can show to potential employers. These should be projects you have worked on in your own time and based on your own code, there should be nothing tying them back to any of your previous/current clients/employers.

As others have stated, you should not share anything you don't own 100%, if asked to, you should instead direct them to one of these examples you worked on in your free time. If you don't have any such projects I strongly suggest that you start now, spend a few evenings and weekends using everything you know to best showcase your skills, you can then not only demo this artefact but walk a potential employee through your codebase to show your understanding of the code without risking exposing the intellectual property of your employer.

Improve this answer
5
  • 41
    Your premise is simply wrong. Many, many developers don't code in their off hours because they have other interests and obligations. That doesn't make them less relevant/valuable/worthy as coders.
    – G. Ann - SonarSource Team
    Jul 25, 2018 at 15:16
  • @G.Ann-SonarSourceTeam - I have yet to go to a job interview that didn't require an example of source code to be provided, just as an artist would be expected to maintain a portfolio of their work a developer should have examples of their source code that they are free to demonstrate and share, web designers may not require source code but a web developer would
    – Lord Jebus VII
    Jul 25, 2018 at 15:27
  • 15
    @LordJebusVII I have yet to hire someone while requiring them to provide code samples. There are a million ways to evaluate a candidates skill without requiring them to provide code from side projects. I love it when I have it, but I certainly don't require it.
    – Conor Mancone
    Jul 25, 2018 at 16:38
  • 27
    Geez. I go in to work each day, eager to write clean, maintainable code that follows SOLID principles. I help teach fellow developers about the concepts, and even give occasional tech talks about "demystifying lambda expressions" and "using xml within SQL". But, alas, when I go home, I de-stress by playing music and games, not spending more time programming. Good to know that I'm not worth my salt, eh?
    – Kevin
    Jul 25, 2018 at 17:07
  • 1
    I've not done any serious coding outside of work for years. After 22 years as a professional software engineer, and 5 years before that as a student, I spend my spare time doing other things. Watch a movie, play games, troll people on Twitter, cuddle the cat (a lot of that, it's so relaxing), swimming, hiking, etc. I'm slowly starting up another hobby project, but my heart isn't really in it and I've not gone much beyond the initial data design.
    – jwenting
    Jul 30, 2018 at 8:38

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .