How forgiving should I be of errors in demo applications referenced in a candidates resume?

Question

I'm working on hiring some more senior level engineers, and a recruiter just sent me over a resume for the person. In there is the url of a website they built for reference. Naturally, I went straight there, poked around, and then did my best to try to break it.

It didn't take very long. Not only was I able to trigger some fatal errors, but I know they were fatal errors because PHP on his server is apparently configured to have display_errors On (a big no-no for security reasons in any production environment).

I haven't even talked to the guy yet, and I already find myself dubious. I consider attention to detail and awareness of security issues to be paramount (especially in senior level engineers), and these issues seem like big red flags for both of those. Am I over-reacting? Is it worth the time to interview him anyway? Everyone makes mistakes after all. I just know that if it was me, I would check any example code I provide with a fine-tooth comb before putting a reference to it on my resume. Thoughts?

Edit it to clarify: the job is specifically a software engineer/web developer. If given the job, the candidate will be building websites for us. I would be hiring him to specifically handle the kinds of responsibilities that he messed up in his demo.

Answer 1

I'd just move on - if a candidate for a senior level position is presenting a buggy demo like that, they'd have been better off not doing it. I've canned a potential vendor just recently for the same reason.

Hosting service limitations on configuration isn't really an excuse - the errors shouldn't happen (a demo site should be simple enough to be fully tested) and, again, someone going for a senior level position should be able to pay for a VPS or even an Amazon instance to take control of their server.

Just to clarify - I don't expect senior level developers to provide a demo - but if they did, I would expect they would put some care and attention into it. If they can't do that for their own demonstration, where they don't have to deal with deadlines and other developers, why would they be any better in a working environment.

Presumably you have other candidates you can spend time on.

Answer 2

A few questions to ask yourself:

• What would you have thought of the candidate had they not provided the website and only their resume?
• What responsibilities will you be hiring for?
• How much time/effort do you believe the candidate put into the website and what was their ultimate goal with the site?

A tendency when interviewing is an expectation of the candidate to have the same "deep" experience as you, thinking of experience as a T - a broad base but some deeper levels.

If you are interviewing where these types of mistakes specifically will be relevant I would weigh that much more highly than if they are tangentially related at best. It's entirely possible these fall into the areas the candidate is less familiar with - or they could be just careless.

I tend to think it's likely the candidate put up a website they spent minimal time working on, assuming no one will go through the level of inspection you did.

Is it worth the time to interview him anyway?

You can always setup a short phone interview where you ask the candidate about these issues. Their responses will almost assuredly determine a concrete answer to whether you want to move forward.

Given you haven't immediately vetoed them, it seems you have enough interest still in meeting with them to make this worth it.

Answer 3

You don't specifically say what type of engineer you are hiring for, but since you mention your expectations for them understanding security issues, I'm going to assume this is for a software engineer position.

If a software engineer puts a URL on their resume, I would assume they intend for that website to be a good representation of their skills. It must be something they are proud of and want to show off. Since web development falls into the realm of software development, even if the position isn't specifically for a web developer, I would take their inclusion of the URL as a declaration from them saying "hey, look, I'm good at this". The fact that the website had such serious flaws immediately calls into question any other skills they claim to be good at (what you describe aren't minor problems. They are things any software engineer should know to avoid, either by fixing them, or not putting up the website in first place). It tells me this person either doesn't know what they don't know, or they don't have enough awareness to figure out that presenting yourself with a skill you don't actually have is a bad idea. Either way, it's a red flag.

As to whether you call them in for an interview, that is debatable. They would definitely lose priority with me, but if they have enough other things going for them and the job won't have them building websites, it might be ok. But I would ask them about the website, and vet them more closely on their other technical skills (including security). Remember, by including the URL they implicitly told you they think they are good at building websites, and they clearly aren't. So I would be wary on what else they exaggerated on.