Software Engineering Stack Exchange is a question and answer site for professionals, academics, and students working within the systems development life cycle. It only takes a minute to sign up.
Sign up to join this community
I have a popular web-based app, and now suddenly my main developer has disappeared. Although I've found other great developers but I don't want to distribute the source code to everyone. Is there any way I can have them work on it while keeping the source code safe?
Thanks
Not really, I mean you could modularize your app in various ways, but then you'll get a fraction of the work out of the devs working on it that you could.
Fact is that developers have to be the product elite - if they're going to be any good at their job they need to know your application inside and out. They need to know where it's good and they need to know where it could be better but you don't have time to fix that right now.
You're stuck trusting them both ways - if you can't trust them with your code then you also can't trust them not to add something that belongs to someone else or that's been GPL'ed and then your whole app's in trouble.
Your best bet is not security by hiding the code from them, but legal protection if they further distribute it.
Software products are not just about code, they're about the knowledge of the application. A new dev can take months to get up to speed, and it takes ages to recover from someone leaving who truly knows your app.
Or to put it another way: spend 5 years writing a large and complex app, move the whole code base to a brand new team and the original team will still be able to have a 2.0 version out before the new team adds any decent functionality to the old code base.
Therefore, most important of all: keep them happy - their in-depth knowledge of your code is invariably worth more than the code anyway.
You can share only specific modules to a particular developer. At least during first few months. Of course, if you have appropriate architecture.
A small oil drilling company found a geologist selling data to competitors. After firing this person, they gave everyone stock in the oil wells. Plenty of incentive for their wells to be drilled in the best location and not some competitor's.
The best that you can do is to modularize code and have developers only access source for modules they need to work on. Use Maven, for example. Of course, you or someone you really trust will have to do integration.
It may be possible to work on certian things but any changes to any primary functionality are going to be very difficult to do with out access to the system. In addition you risk introducing conflicting logic and redundant code because you do not want to allow your developers to see what already exists.
Your best option for securing your code would be to have them work onsite, in a location where they are not able to bring personal items in or out, On a machine with USB access restricted (preventing usb drives). Do not provide any internet access(at least on the machines where the code exists) so that the code can not be sent outover the internet. You will also want to limit network access to these computers from machines on your network that have internet access. A seperate network not connected to any outside network is probably the best way to make sure of this.
This will help keep your sourcecode from being duplicated outside of your control. But it is no guarantee. This is also going to reduce the productivity of your developers. Not to mention unless the developers buy in to the need for the security it will likely impact morale.
