9

I've turned in my resignation and will be leaving the company soon. I was the last member of the original development team (and the lead) for our project, so new people are being moved to the project to take over. The replacement programmer for this project has been with the company for years and seems well respected.

The new programmer has been asking me some questions and writing some code over the last few days, and they sent in a first pull request this week.

After review, it turns out there's a rather massive security issue with the code. It's on such a level that I would expect even fresh programmers to know better. (the gist of it: they put the root credentials for a backend server in the javascript client-side code so the client could load some client-data from a backend server that doesn't support user accounts. That backend is normally accessed through a second backend which does support specific user accounts, and handles making sure only the right data is loaded.)

The system contains quite a bit of sensitive data, and if this code had made it into production, the company could get in serious trouble. Now, I caught the issue and nothing happened, but this programmer will become the lead when I'm gone and I fear they might make another mistake like this.

Should I issue a warning to management about what might happen after I leave, or is this more of a "not your problem" situation and is warning them about these things more of a faux-pas?

|improve this question
  • 2
    Why is it possible to directly access the client to the backend that it shouldn't be connecting to (it should be segregated via firewall rules if you want to force access through the other server)? Is the correct way to connect documented at all? Just because it's obvious to you (who I assume developed this or at least was involved) doesn't mean it's obvious to a new person. – HorusKol Aug 17 '17 at 6:42
  • 10
    @HorusKol the concern is more that someone would put root credentials to a service in a javascript client AT ALL. I agree that the other service should have been secured better as well, but "don't put anything sensitive in the JS client, ever" is the first (and only) rule of JS security. – Erik Aug 17 '17 at 6:44
  • Ah - I just saw your edit. It's a bit of a concern, true. But I would first talk to the developer to see why he did it, and decide to talk to management depending on how that discussion goes. – HorusKol Aug 17 '17 at 6:48
  • @HorusKol the developer's response (after I explained the issue) was that they learned something new. So the why seems to be that they didn't know better. – Erik Aug 17 '17 at 6:49
  • 3
    I don't even code JS or do web development and I know that's a no-no. – SaggingRufus Aug 17 '17 at 10:59
13

It largely depends upon how good a relationship you have with your soon to be ex-employer - as a minimum I would raise the specific issue that you refer to in the question in the same way you would have done if you weren't leaving, then leave the company to come to any conclusions it needs to regarding that person's future in the role. If you have a particularly good rapport with your manager it might be worth an unofficial "quiet word" with them regarding your concerns.

|improve this answer
  • 1
    I agree he should raise the concern of the issue itself, but its not up to OP decide if this guy is fit to lead the project. Just bring up the issue and make sure management know the extent of the security risk that was avoided. They should be making the decision right or wrong. – SaggingRufus Aug 17 '17 at 10:42
1

No, unless you know somebody in the company or available who is suited for the tasks you see the problem with. Rationale: if you see the solution to somebody else's problem (management) tell them, if you like them. If you don't see a solution, then report the problems with the code, and let the problem of your former bosses be their problem probably they are already aware of the issue.

|improve this answer
  • 3
    "probably they are already aware of the issue". This is an assumption with no basis whatsoever. – Stephan Branczyk Aug 17 '17 at 15:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.