i find a security vulnerabilities but my company dont put time to fix it I work as Developer in a big company, I found security vulnerabilities that let me login to any user accounts in the system. I told my team and my boss for about 9 mounts ago. my project manager and my team leaders don't prioritize the ticket so it gets done by somebody. What can i do? I have signed contract so i cant just go out and tell about it to somebody outside the company. What if i stooped working there right now? can i tell or write about it on my website or blog? Can i do something without getting fired or get in trouble ?
Every software is potentially vulnerable, unless it runs on an air-gapped computer with sealed data ports. How vulnerability fixes are prioritized against other goals is usually a business decision, legitimately made by the management. There are some jurisdictions and issues where the law requires them to act, but again there is usually a judgement call involved. For example, the GDPR talks about due regard to the state of the art. What you describe seems to be a difference in opinion about the importance of the fix. Ask about that at Workplace SE, not here. There are ways for software developers to influence their management, but ultimately the management is responsible for the outcomes and gets to decide. You can inform your superiors, in writing. If you are in a large company, there may be a legal or compliance department. Inform them if you have a reason to distrust your superiors. In most jurisdictions, you cannot simply talk to the press, either now or later. If you believe that your company is acting criminally, talk to a lawyer.
I would recommend talking to an adult person in HR. I'm quite sure they will notice that what your manager wants to do is more than dodgy, and doing something dodgy may be in the interest of your manager, but not in the interest of the company. The best thing is to go to HR, acting as if a mistake has been made, and point out to them what your start date was, and that the new contract has the incorrect starting date, and they need to fix this mistake or you can't sign the contract. If they insist you sign it, then you DON'T sign it. If they say you will be fired if you don't sign it, then you tell them that in that case you would get legal advice. BTW. You definitely don't sign this as it is. PS. This answer was posted on workplace.stackexchange, not law.stackexchange, so please don't complain if there is no legal content.
I am not knowledgeable about UK law, but since almost everywhere in the U.S. employment is at-will by default, in all three scenarios Company B is entitled to terminate the employee very easily. The assumption that the employee was accurately found guilty of harassment elsewhere precludes more interesting analyses where matters such as defamation and public policy are involved. If the contract between the employee and Company B establishes that termination will be for good cause, the employee has only a mild chance of not being terminated for what he did in Company A. However, I say "mild chance" because in most cases Company B can reasonably argue that it seeks to protect its other employees and/or customers from the possibility that the employee's misconduct may occur in the current workplace. A very detailed analysis of the factual circumstances might be required for discerning whether Company B's decision to terminate the employee is merited. Additionally, in cases where The Employee is a publicly visible figure and a figure of authority having a management role there could be a concern that the employee's misconduct elsewhere may harm the image of Company B.
Be careful of the 10% time “perk”. It is not your own time. It is work time where you are self-directed. Any project unrelated to your work should be on your actual own time not dork time that is free of specific assignment. Fortunately the section 39 of the UK patent law is short and relatively straightforward. It is focused on “the course of your usual duties” not on whose time you were on or whose equipment you were using. It belongs to them if - (a) it was made in the course of the normal duties of the employee or in the course of duties falling outside his normal duties, but specifically assigned to him, and the circumstances in either case were such that an invention might reasonably be expected to result from the carrying out of his duties; or (b) the invention was made in the course of the duties of the employee and, at the time of making the invention, because of the nature of his duties and the particular responsibilities arising from the nature of his duties he had a special obligation to further the interests of the employer’s undertaking. Otherwise it’s yours. See https://www.gov.uk/guidance/the-patent-act-1977/section-39-employees-inventions-right-to-employees-inventions
Read it carefully. "Work additional hours as required by the nature of your work assignments". Does the nature of your work assignments require additional work hours? That's very unlikely. It may be that your boss wants you to do three weeks work in two weeks, but it's not in the nature of your work assignments that they take two weeks. If it's three weeks of work, then it is actually in the nature of your work assignments that it takes three weeks. It may be in the nature of a work assignment that once it is started it must be finished quickly. For example if you are a plumber, it may very well be that once you start a job and unscrew the first screw, that job must be finished. In that case, you can't go home after 8 hours and leave a job unfinished which could be a major problem for your customer. Are you in a similar situation? If your company is too tight to hire enough people to do the job, and deadlines will be missed if people work 40 hours a week, that is not in the nature of your work assignment - it's because your company is too tight to hire enough people.
You need to be very clear with B that you intend to continue to operate A. You need to be clear whether you are to be an actual employee of B, or a hired contractor for B. If an employee, you need to agree with B how much time you can devote to A while employed by B, or to put it another way, how much time (per day, week or whatever) you are expected to devote to B before doing stuff for A. Are there to be restrictions, such as a ban on your doing things for A while at B's worksite? Above all, you need to agree on who owns what rights to both the existing A code, and any new code will be held by you, and what rights will be held by B. All the above should be in a written agreement, and you would be wise to have a lawyer draft or at least review the language. If B will not agree to this, you will have a choice to make: put A on hold while working for B, or not accept B's offer. Do not lie to B about what you are doing with A. Oh, and if you had any sort of non-compete agreement at the job you quit four months ago (let's call them C) be sure that you comply with it, or are prepared to fight it. If there is any question, this is another area where you would do well to consult a lawyer. Many non-compete agreements claim more than local law allows, and are not enforceable. Many others are very much enforceable. It depends on the wording of the agreement, and the provisions of the law where you are located. Also, do not use any confidential data from C without C's written permission.
Congrats, you've done well to minimize your processing of personal data. But I think you're still processing personal data, and are subject to the GDPR. Serving a website necessarily involves processing an IP address. This IP address will typically be personal data. While you are not storing the IP address, the GDPR's definition of “processing” extends beyond storage and pretty much covers doing anything with that IP address. As far as I know this is not an entirely settled matter, but it's better to err on the side of caution and to assume that you are in fact performing a processing activity. Even a static web page can easily lead to additional relevant processing of personal data, for example if the HTML embeds resources from third party domains. Since your website is clearly targeted at the public, it does not fall under the GDPR's exception for “purely personal or household” purposes. So I think you do need a (minimal) privacy notice that contains at least the items mentioned in Art 13 GDPR. The main reason why some people try to avoid posting a privacy notice is because it must disclose your identity and contact details. But in Germany, that information has to be provided anyway due to the Impressumspflicht. As part of your GDPR compliance obligations, you must protect how data is processed by others on your behalf. A hosting provider will typically act as your data processor. For this to be legal, you need a contract / data processing agreement that fulfills the conditions in Art 28 GDPR. This contract binds the data processor to only use the data as instructed by you, and not for their own purposes. European hosting providers sometimes include the necessary terms in their terms of service / AGB, but you should check to make sure. Netcup expects you to accept their data processing amendment in your account settings. In the hypothetical case that you were not processing any personal data at all, the GDPR would not apply and it wouldn't require you to post a privacy notice. Other laws might still have information obligations, notably the German TMG and TTDSG.
The &quot;Severance Agreement&quot; is a contract between the company and you. It spells out what the company will do and probably what they expect you to do going forward. Simple enough. The statement you referenced merely says that you are not being forced to sign the agreement. That's all. You don't, presumably, have the option of remaining employed at this company but you DO NOT have to sign this agreement. But if you don't, it's likely that any benefits being promised in the agreement will not be delivered to you. So specifically in answer to your questions: It protects them against a claim that they somehow forced you to sign the agreement. Likely anything that the agreement says the company will do such as pay you a certain amount of money and the like. Bottom line is that if you don't like the agreement, don't sign it. If you want the benefits they are promising in the agreement, then sign it and move on.