can i write in my portfolio about a critical security bug in my last job? I want to write about how i found a critical security bug when i was working at a company. Am going to stop working there in about a month and was just updating my portfolio with the things i did there over past three years. The thing is for me this was a very big achievement and i want to brag about it, but my boss told me i have to take it down immediately or i will get in trouble. It was no details about any system or programing language and just a paragraph about it on my portfolio page. What part of my contract or any contract can give employer right to do so? This just dont sound right that i cant tell other employer how good i am
The employee must, during and after employment, without limitation in time, observe a duty of confidentiality regarding [...] the Company's internal affairs such as business plans, profitability, pricing, employees, methods, processes, routines, code and the like as well as other information that the Company typically wants to keep secret The pure information that the company had at some time a security problem with their product is internal knowledge you only gained through working there. By what is written here, you are indeed prohibited from speaking about it. If it were public knowledge, you could point to a press release and say &quot;I did that, that was me fixing the problem&quot;. That would work. Because it doesn't share anything that isn't public anyway. But you cannot share things the company wants to keep secret. Finding out whether that contract is legally enforcable in your country and juristiction is the job of a real lawyer, but just as written, they are right. You signed a contract to not do that, not talk about it an certainly not publish it on the internet. So you should not do that, unless a good lawyer you trust tells you otherwise. That said, &quot;I found a security flaw&quot; is about as impressive as &quot;I found a dollar on the floor&quot;. Maybe you can talk about your knowledge to prevent something like it happening. That says nothing about whether or not it happened in your old company, and for me as an employer it is much more valuable to have you on board with structured knowledge you can apply, than with your memories of being lucky once.
Not very nice of the employer, actually quite cowardly. Being not nice and cowardly is not against the law. Being in the EU, and having been employed for ten years, the company will have duties to find a different position in the company at the same pay, and only when that fails, the employee can be laid off and will have a reasonable amount of notice, plus a reasonable amount of redundancy pay due to him. Unfortunately, he can expect only the legal minimum if the company behaved like this already. Good companies would provide a generous redundancy pay, plus pay for you to have any agreements checked by an employment lawyer of your choice - which means the employee can be sure they are not ripped off, and the employer is sure they cannot be sued for any reason. Obviously if they want him to quit, then the one single thing your relative mustn't do is to quit. Let them pay him. Plenty of time to look for a new job.
Every software is potentially vulnerable, unless it runs on an air-gapped computer with sealed data ports. How vulnerability fixes are prioritized against other goals is usually a business decision, legitimately made by the management. There are some jurisdictions and issues where the law requires them to act, but again there is usually a judgement call involved. For example, the GDPR talks about due regard to the state of the art. What you describe seems to be a difference in opinion about the importance of the fix. Ask about that at Workplace SE, not here. There are ways for software developers to influence their management, but ultimately the management is responsible for the outcomes and gets to decide. You can inform your superiors, in writing. If you are in a large company, there may be a legal or compliance department. Inform them if you have a reason to distrust your superiors. In most jurisdictions, you cannot simply talk to the press, either now or later. If you believe that your company is acting criminally, talk to a lawyer.
Sorry, what did I agree to? NDA means New Drug Application, right? Or is it Notre Dame Academy? Maybe it's Nebraska Dressage Association - don't want to cross those guys, their horses are mean. When you are trying to form a contract with someone, it's very important that you and they are talking about the same thing. What can't I disclose? That I had a phone call? What I said? What you said? Only the confidential bits? If so, what are they? Can I tell my business partner? My lawyer? My secretary? The IRS? Another important thing about making a contract is to agree on the terms. Post-facto contracts are not a thing After you paint my fence, you can't demand payment. We have to enter into a contract before the thing that happened happens. Elements of the call might be confidential anyway I am bound to respect confidences that were entrusted to me where a) the information is confidential b) it was imparted to me in a situation of confidence and c) disclosing it would cause harm. We don't need a Non-Destructive Analysis to document that.
I think haveibeenpwned would be legal in the EU because it carries out a task in the public interest (Art. 6(1)(e)), and it shares no more data then necessary, for example you can search for a password, but it would not show you the emailaddress which belongs to that password. It would also be legal for you to hold a copy of a leaked database, but only if you have a legitimate interest (Art. 6(1)(f)) to have it. Being a security company does not change that, but finding a legitimate interest might be easier. If you have a legitimate interest to hold a copy of a leaked database, it does not mean you can use it in any way you like. For example testing if the password still works, is very likely illegal everywhere in the EU. But I'm not familiar with the UK laws.
could they make a realistic claim that I had voluntarily terminated my contract before the year was over? The employer's act would forfeit its entitlement to reimbursement of bonus. The clause clearly indicates that the triggering event is termination, not the anticipatory notification thereof. Furthermore, the employer's act would be a breach of the [contract law] covenant of good faith and fair dealing. That would be in stark contrast with your compliance with, and/or kindness in, giving a two-week notice. The employer's termination of your employment seems improper in equity insofar as it was aware of your notice and thus took advantage thereof.
Liable, yes. How much liable, depends. There would be copyright infringement, and with copyright infringement the exact facts count. Like did you commit copyright infringement to make money, were you aware that you committed copyright infringement etc. With your contract, it seems clear you didn't set out to commit copyright infringement to make money (because you paid someone else telling them not to commit copyright infringement). Up to the point where you learned what happened, you didn't know it was copyright infringement. After this, you better remove all the infringing works, because now you know it's copyright infringement, and now you are saving money by not hiring a second developer. Obviously you can sue the employee for damages.
An agreement to agree is void There is a multitude of case law on this point. If the NDA was not available to you when you signed the employment contract and the term was couched as you describe; then the term would be unenforcable. That is, your employment contract would be binding except for that term i.e. you could not be compelled to sign the NDA. Now, there may be a requirement on you to negotiate in good faith in an attempt to find an NDA you can agree to but if you can't find one you can't find one. You cannot (legally) be fired for this reason. Now, if the NDA was available, and you were told where to find it, and irrespective of if you did or didn't find it, you would be bound to the NDA.