29

I'm a software developer at a well-known financial company. My team consists of three junior software developers, and our team lead has taken more of the manager, hence there is really no supervision on the quality of the code.

About six months ago, we were asked to work on a relatively large project and decided to get the help of another team. We instantly regretted collaborating with the other team due to their attitude, work ethic and lack of communication. I think they probably feel the same about us, but that's a different story. We divided responsibilities (different applications/different code sources that work together as one, basically micro-services) and until about a few weeks ago one of the best developers of the other team (I am not going to hide it but she is very smart) was talking to us about a number of her GitHub repos and their stars. I saw she has a lot of repos, to the point that she is like full-time open source project contributor.

Fast forward to last week, I saw she has contributed to the application and that wasn't her responsibility, but I saw she deleted a lot of code, and added a reference an external package to replace them. I got curious and I saw all the code that was deleted is in her personal GitHub.

We confronted her recently and she got very aggressive but she argued that we use random people's open source library and it's not different.

I am concerned that not only this behavior will not professional but we dangerous as it paves the day for hackers to find security holes because a lot of security utilities codes are also shared in her public GitHub. By quickly glancing her GitHub, I see a lot of code that is obvious that it has been taken from the company.

I will have a 1-1 meeting with my manager in a few days, and I am wondering what should I exactly say. Is this behavior professional? is it even legal? I don't want to be responsible for someone else's actions.

Update: I sent an email to the manager and requested a few minutes of 1-on-1 meeting to explain the situation. She got fired immediately after the meeting. The manager said it is too late to take back the code and the company will not attempt to take back the code.

Improve this question
10
  • 8
    "is [copying company code to GitHub without permission] professional?" No. The reason that you may copy "random people's open source library" is that the open source license says you may do that. Company code used internally is not usually open source; some of it may be open sourced, but usually not all. Also, code that you deleted from the code base is still company code.
    – Brandin
    Commented Sep 12, 2018 at 4:58
  • 13
    I live in a jurisdiction with strong employee laws, but making company code available to the public could you get fired immediately even here. Her reaction makes it even worse, because she seems not to understand what's the problem. Talk to your manager immediately, because not reporting that could get you fired as well.
    – Simon
    Commented Sep 12, 2018 at 6:36
  • 2
    Escalate up, make legal hit her. At this point she is, for your company, a criminal that has stolen code and published company confidential information - not your's to handle.
    – TomTom
    Commented Sep 12, 2018 at 6:43
  • 5
    Is it even possible that she first wrote the code on her own time, then added it company code, then removed it again, leaving a reference to her personal github code?
    – Mawg
    Commented Sep 12, 2018 at 9:27
  • 2
    @Mawg i don't think it matters at all, if it is internal code then regardless of when she wrote it she's going to be out of a job
    – bharal
    Commented Sep 12, 2018 at 15:58

4 Answers 4

Reset to default
23

Do not wait for the one-on-one!

Email your boss immediately with links to this developer's "contributions" to your company's private repo, and links to their public library. Say that you think something is odd, but then let your boss handle it.

Don't talk to the other developer any further on this issue.

Side note: it is one thing to use libraries of other developers, or even of company developers who build those libraries outside of work. It is quite another thing for a developer to take code from their company and claim it as their own (without permission)

Improve this answer
30

You definitely need to tell your manager this, as this is (unless she has gotten permission and you don't know about it) a major issue that needs to be stopped immediately. It's virtually certain she'll be fired, but that's not your problem.

It's not bad to open source internal utilities and then use them - we do it - but that's a decision that requires management and legal signoff, not to be done at the whim of a given developer.

Don't editorialize - just say "Hey boss, so I noticed it looks like Smartypants1 has been taking chunks of company code and posting them publicly on github, that seems unusual and I thought you should know." If he's like "it's fine we let any senior devs do that" then that's the way it is. He won't. When he/people in your company authorized to investigate this (not you) look into it, they’ll determine what happened and the right course of action. Your responsibility starts and ends with passing on what you’ve seen as something likely to be an issue.

Improve this answer
10

Taking code from a company is equivalent of stealing (even if you wrote this code yourself).

The code is the intellectual property of the company, not of the developer creating said code. That means the company is the only one who can decide to share the code. All work contracts I ever saw (I work in central Europe) always contained at least an entire paragraph about any and all code belonging to the company.

Using Code that the owner decided to share (open source) is OK, but publishing code without the explicit permission of the owner is illegal.

You have to report the developer to your manager and let them decide on the concequences. They might give her a written warning and have her remove the code immediately, but they might as well terminate her without notice.

The important detail here is that you become an unwilling accomplice if you don't report her.

Improve this answer
6

Yes, it is unprofessional, and depending on your contract even illegal. You should not wait until your meeting but take immediate action and contact your manager.

This is not only theft, but a high risk for the project altogether. Imagine if she deleted the repository your product relies on. Sure, the code is still on your version control, but you'd have to search for the deleted code and it is uncertain there weren't any additions in the meantime.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .