I work as a software engineer. Few years ago I was part of software development team, where I wrote code for a back-office system at a bank.

Recently I discovered on GitHub, that one of my coworkers at the time, uploaded parts of code I had written for the bank, and had made some minor changes with indentation (changed spaces to tabs).

I was alerted to this by one his current coworkers (at a new place of employment, yet similar problem domain), and mutual acquaintance, who suspected something was up (or not quite right) when he was incapable of properly explaining why he'd written certain pieces of code in a specific way during a code review session.

At this point what is it that I should do?

I personally do not want to do anything at all as I no longer work at the bank in question and also I don't see any upsides from my point of view.

But at the same time I am unsure of my obligations now that I've been informed of the situation and did review the code and concluded its origins.

  • Do you still have any informal/social contacts with people at the bank? May 18, 2017 at 0:28
  • @PatriciaShanahan I keep in touch with some colleagues once a year, but that is about it.
    – Magnus Man
    May 18, 2017 at 0:29
  • Are you in touch with the coworker?
    – Masked Man
    May 18, 2017 at 1:00
  • 3
    Does your ex coworker still work at the bank ? May 18, 2017 at 7:24
  • 1
    I am not sure I should write this as an answer, but considering the context (bank) I do strongly disagree with answer telling to not do anything, because I would really don't want to know that this usurpartor participate to wrote anything related to my own bank. This is basically the same philosophy on SO when people don't want to see blatlanty insecure code, "it could be copy/pasted in the software that will manage your bank account".
    – Walfrat
    May 18, 2017 at 12:44

5 Answers 5


On the face of it this isn't your problem. Someone you vaguely know told you that someone else you vaguely know might have done something that is at the very least wrong, but possibly illegal. If your neighbor told you that "my former neighbor where I used to live totally [breaks a law] all the time" you wouldn't feel any obligation to phone the police.

However, there's an interesting wrinkle here that you are able to confirm that it's your code, and furthermore that you went and did that. This puts you in a position of knowing that something wrong and possibly illegal has happened. I don't know whether that puts a legal imposition on you or not. I would feel like I owed it to my former employer to at least tell them. I wouldn't spend my own money for a lawyer; that's crazy. But I would contact someone at the bank. A quick phone call or email in which you give them the GitHub repo address, and tell them what you have concluded - this is the code you wrote, with tabs changed to spaces.

Then wash your hands of it. The person you report it to may followup on it or they may not. The repo may disappear, or it may not. The former coworker, who doesn't seem to be gaining much by claiming to have written this code, since others are seeing through the ruse pretty quickly, may "never work in this town again" or may continue to lie and cheat in order to get hired, for whatever reasons. But you will have done your part. You won't have helped the theft by keeping quiet once you know.

And keep a record. Save your email and any you get in reply. Or if you call, write out notes (pen and paper or digital) about who you called, what you told them, what they said. If there is some back and forth in response, update your notes every time you talk to anyone. Put these notes somewhere safe. Should it ever happen that someone else discovers the repo and accuses you of being the leaker, liar, cheater, you will want to be able to show that you reported it when you found out, and be able to tell them who you reported it to.

  • 1
    those are an excellent set of recommendations, I've written a record and made a copy of the repo and archived it and registered a commitment of the HMAC on the bitcoin block-chain via proofofexistence to prove time-line.
    – Magnus Man
    May 18, 2017 at 23:17
  • 1
    @MagnusMan You don't think that's a little extreme? Jul 13, 2017 at 9:14
  • 1
    "keep a record" dimension is very true and missing from most other answers. Since the code is originally written by OP, it is very likely that in future, fingers will be pointed at him for this leak.
    – LionsDen
    Apr 4, 2018 at 11:47

Don't do anything.

It's his problem and the bank's problem.

The code you wrote belongs to the bank, you have nothing to do with this issue. Forget about it and don't go looking for trouble.

DO NOT consult a lawyer. It is not your problem.

  • that sounds like sane and sound advice - my only concern what that the mutual acquaintance knows that i know because he told me about it and the code is not only on github, but that he seems to be using it and other code at least in his current place of employment.
    – Magnus Man
    May 18, 2017 at 3:04
  • 11
    @MagnusMan Your mutual acquaintance should bring that up with his boss, not with you. Again, it is not your problem.
    – Masked Man
    May 18, 2017 at 3:56

Essentially the banks property aka proprietary code(which in the contract you had signed I assume was given full rights of, to them) was stolen from them by someone unrelated to you and posted on an unrelated to you github account. I really dont see why this should worry you or how it can be incriminating for you. Feel free to inform (in written) the bank's representative of this and let them sort it out however they see fit if this matter troubles you and you think you should do something about it to be 100% covered.


You don't have any specific responsibility in this case.

However, as this is your code and you're aware of it having been stolen and posted in this way, it does open you up a little to being seen as a participant in it if they do eventually find out and investigate. Let's say your former co-worker brings up your name to throw you under the bus. "Well Magnus gave it to me and said it was fine to reuse/post..." "Github records show you accessed that repo yourself..." It's not so much legal obligation as now being open to someone possibly putting this on you and there not being much proof either way.

I would send a note to the bank indicating what you saw (hey it seems like code I wrote for the bank back in the day is now on this public github account) and going on record as having no part in it (I have nothing to do with it and don't know anything about the circumstances, just saw it and wanted to pass it on), just to CYA from any possible entanglements in the future. It does mean they might try to get more info out of you about "is this your code, can you swear to it" etc., but that you can respond to with "hey, it looks like it, but it's been years, you'll have to pursue that yourself."

  • While this is a good answer what does it actually add that's new compared to the other ones?
    – Tim B
    May 18, 2017 at 13:39
  • 2
    The entire concept of needing to avoid possible blame for the code theft?
    – mxyzplk
    May 18, 2017 at 14:02
  • 1
    That is an important point, but it's covered by the last paragraph of Kate's answer, maybe some of the others too...
    – Tim B
    May 18, 2017 at 14:14
  • Feel free and vote your conscience then.
    – mxyzplk
    May 18, 2017 at 17:14

It's his GitHub account, not yours. Culpability points to him.

Not the answer you're looking for? Browse other questions tagged .