So I found a flaw in a product my employer sells. My position in the company is such that they allow me to work on projects, but if I want to keep enjoying the good will I've managed to instill in my boss, I'd better not question the code of previous employers (office politics have run amuck in the company's priorities).

Unfortunately, I've found a pretty glaring flaw in some legacy code that I've been referencing. The company has been going this long without it biting them in the butt, but it is an issue. I don't feel comfortable pointing things like this out to my boss because he takes it personally and gets this idea that I'm trying to run his company for him. In a way, by pointing out a flaw and suggesting it needs fixed, I can see how it could be argued, I AM trying to run his company a bit.

This is a bit of a difficult situation, but I guess what I'm asking is how do you openly point out an existing flaw when office politics already have you in a fragile position? Alternatively, should I just keep my yap shut and let them sink or swim if the problem ever surfaces with a client?

  • 35
    If you can't point out a software issue without risk of getting fired, then you should start looking for another company.
    – David K
    Sep 22, 2014 at 15:50
  • Do you have a solution?
    – user8365
    Sep 22, 2014 at 15:59
  • @JeffO - Unfortunately, I don't. I also don't feel comfortable taking the time to find an extension, because that will be perceived as me going off on my own without first getting clearance to work on it. IF you can imagine, also not a good thing for my position.
    – Sidney
    Sep 22, 2014 at 16:05
  • @Sidney The best course of action is going to be cultural specific. Boss/worker relationships have different expectations in different parts of the world. What country are you working in?
    – Myles
    Sep 22, 2014 at 19:06
  • report bug or replicate it in real time so it gets reported :D
    – amar
    Sep 23, 2014 at 6:15

4 Answers 4


I would argue that's it's your responsibility to raise flaws like this. If the flaw were to be exploited you'd be kicking yourself for not speaking up. Since the hard part seems to be communicating to your boss, maybe you just need to change your presentation approach.

Rather than saying "this is a flaw that needs to be fixed for reasons X, Y, and Z," you could ask for your boss' opinion. Tell him in a casual way you found a potential issue. Ask him if he thinks it's serious, and ask for his opinion on a next course of action.

This way you've met your obligation and still communicated it in a manner that allows your boss to maintain control.

If you want to go completely passive and non-confrontational, you could even ask your boss if what you found could even be considered a flaw.

  • 4
    For bonus points, suggest a fix at the same time that you report the flaw.
    – keshlam
    Sep 22, 2014 at 16:08
  • 2
    @JeffO if the flaw is exploited and the boss asks the OP about it, the OP will get blamed no matter what the OP's response is. If the OP asks what the boss thinks about the flaw, that may provide enough cover. If the boss is completely unreasonable no matter the approach, then this is not an acceptable working relationship.
    – mcknz
    Sep 22, 2014 at 19:51
  • 2
    @keshlam, He said the environment is very sensitive and they are defensive to being corrected. In this environment you shoudl definitely NOT offer a solution. Just point out, you found something of concern that you thought he might want to look further into. Don't offer criticism or solutions. If they want a solution they will ask. Sep 22, 2014 at 20:13
  • 1
    @BillLeeper: We're both guessing. I'm sticking with my guess. Your mileage will vary.
    – keshlam
    Sep 22, 2014 at 21:30
  • 1
    I think David K had it right with " If you can't point out a software issue without risk of getting fired, then you should start looking for another company", but yes, asking your boss "do you think insert flaw here might be a problem?" rather than telling them that it is a problem is a good diplomatic approach to avoiding conflict whilst at the same time being able to say "hey, I tried, they ignored me." Sep 23, 2014 at 1:27

The CRM model of communicating

This is a very old post, but for the sake of people finding themselves in a similar situation...

Crew Resource Management provides a method to communicate serious issues in such a way that it increases your likelihood of being heard. CRM was created for flight crews but can be used elsewhere as well.

The method is thus...

  • Opening or attention getter - Address the individual: "Hey Chief," or "Captain Smith," or "Bob," or whatever name or title will get the person's attention.
  • State your concern - Express your analysis of the situation in a direct manner while owning your emotions about it. "I'm concerned that we may not have enough fuel to fly around this storm system," or "I'm worried that the roof might collapse."
  • State the problem as you see it - "We're showing only 40 minutes of fuel left," or "This building has a lightweight steel truss roof, and we may have fire extension into the roof structure."
  • State a solution - "Let's divert to another airport and refuel," or "I think we should pull some tiles and take a look with the thermal imaging camera before we commit crews inside."
  • Obtain agreement (or buy-in) - "Does that sound good to you, Captain?"

You should do this by yourself first, and write the whole thing down. This lets you put words on...

  1. What you think the issue is
  2. What kind of problems and risk you think the issue presents to your employer
  3. What you think a good solution might be

This bit is important because it allows you to be critical of yourself and your suspicions. It lets you find proper arguments for your misgivings about the product. It lets you move beyond "Y'know... I think does not look quite right" and instead find yourself where you can say "If this scenario becomes reality, the company stands to lose a lot of reputation and [amount of money]".

Try it, and see how it works out for you.

  • 2
    I've used this before and it works well in an office setting. The only caveat I have related to this specific situation is that "proper arguments" is audience specific. What might be a convincing problem to you (eg.Tracking costs at high granularity is impossible) might be a triviality to the decision maker. Security can be difficult to convince decision makers that a problem exists because of the low frequency nature of consequences from it.
    – Myles
    Aug 29, 2018 at 14:49
  • In the OP's particular situation, which is much less life-or-death but may be career life-or-death, I would suggest "State a Risk" instead of "State a Solution": "If we keep going, I'm we might crash", "If the roof collapses, it could kill the crew" and then "Solicit a Suggestion" rather than "Obtain agreement": "Do my estimates check out with yours? Should we divert?" or "Should we check with a thermal imaging camera before proceeding?"
    – Eric
    Sep 12, 2018 at 1:16

When you point out something negative, people have a natural tendency to go on the defensive. There are a bunch of pointers which you can get from the book "How to Win Friends and Influence People" - you can go through this summary if you don't want to take the time to read it.

The thing is that once the boss goes on the defensive and the conversation deteriorates into an argument, there's little in the way of communication as it's mostly noise. So you have to be subtle about how you break the news to him.

One way is to use a compliment sandwich, in which you start off with a compliment in order to set a positive vibe, then you break the (negative) news, and then you end with another compliment so as to not leave on a negative note.

The book (and summary) I mentioned above has several other tactics you might want to look at. Some include:

  • Begin in a friendly way. Focus on the things you have in common, and get your boss to say "yes" a lot.
  • Let the person feel that the idea is his or hers.
  • Appeal to the nobler motives.
  • Really you should see most of "Part 4: Be a Leader: How to Change People Without Giving Offense or Arousing Resentment" which is more or less what you need.

My question would be to you: Have you been reprimanded in the past for raising concerns like this to your manager? If you have, then I would just drop it. One day, this piece of code will break, or become unmaintainable, and it will become SEP* (Someone Else's Problem, a Hitchhiker's Guide reference). At that point, someone else (ideally your manager, or a tech lead, probably, due to the severity and complication of the issue, so someone nontrivial) will have to put a lot of effort into solving the problem, and you can sit back and laugh* while they waste their time on something that could have been fixed, if only they'd listen to you.

However, if you have not been directly reprimanded for raising concerns in the past, then you should raise this as a concern. Explain what the issue is, why it's an issue, and ask if they want it fixed. Don't suggest a fix or start work on a fix, just ask if it's business critical and if they care. Maybe they don't care, in which case, see above*. If they do want it fixed, then you can work on a fix. However, I wouldn't argue with the boss on this; if he says "no, it's fine", then the answer is "no, it's fine" and that's the end of the discussion*, you've done your duty as an engineer by raising the issue and that's where your responsibility ends.

*All this is predicated on the fact that this sounds like a pretty horrible place to work, and you should probably search for another job. Then it won't be your problem to fix this problem in the future when production explodes and upper management makes everyone work 16+-hour days until it's fixed. Then you can laugh from your ivory tower at all the issues you saw coming due to the focus on office politics over functional products.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .