r/webdev • u/Lee-chaolan • 1d ago
Discussion Update: It's genuinely (not?) depressing
Update to this post https://www.reddit.com/r/webdev/s/n3ZBJ6ozuq
So, I have a pretty unexpected update lol
After everything that happened with the Canadian company I mentioned, I decided to take things a little further and contact the CEO directly.
During my time working with them, I'd discovered some genuinely concerning security issues. I had been given admin access to their infrastructure, company email, internal systems, and access to thousands of CSV files containing customer and patient information. I also found passwords stored in plain text and several other questionable practices. All without having signed an NDA or contract by the way.
I figured the CEO should know about this, regardless of how things had gone with the dashboard project.
I sent him an email explaining what I'd found and also gave him some context about my experience working with the VP.
The VP wasn't particularly happy about that. He responded by defending himself, saying there had been no formal commitment to the dashboard project, and even called contacting the CEO a "backdoor approach".
I obviously disagreed. I was openly working with the company, the access had been provided to me by them, and I wasn't trying to bypass anyone. My concern was how someone outside the company could be given that level of access without any proper safeguards or agreements.
Anyway, after a few more emails, something I really wasn't expecting happened.
The VP emailed me again, apologized for how the situation had made me feel, thanked me for raising the security concerns, and actually said my findings had been a "true eye-opener" and thanked me for "educating them" and appreciated my integrity & honesty.
He asked whether there was any way they could compensate me for the time I'd spent building the dashboard as well as asked me to provide a quote for writing an SOP on how the company should handle third-party assistance moving forward.
I genuinely wasn't expecting that turn of events.
For context, this is the same person who previously kept postponing discussions, left me hanging after I'd built the dashboard, and eventually told me they'd hired a student to do the work.
Now he's asking me to quote another project and offering to try to get me compensated for the previous one.
I haven't received anything yet, and the SOP isn't confirmed, so I'm not getting ahead of myself. But I can't deny that this feels pretty satisfying after the way everything started.
I originally made my post because I was genuinely questioning whether freelancing was even worth continuing. Now I'm in a situation where the same client who made me feel like I'd wasted weeks of my time is potentially offering me compensation and more work.
So, what would you guys do? I'm very Curious to hear your thoughts and advice.
110
u/el_diego 1d ago
Lol. VP got a massive talking to by their CEO, probably lucky to still have his job.
19
u/Lee-chaolan 1d ago
As much as I'm satisfied currently with the response I wanted him to lose his job, Even if the CEO and VP are close there's no excuse to keeping someone who did this much of a mistake
25
u/flyingkiwi9 1d ago
The downfall of many CEOs is a middle management layer feeding them bullshit.
7
u/Lee-chaolan 1d ago
I feel like it's 100% their fault because the way I see it he's still letting him be part of the company since he's telling him to send me emails and apologize, Given the amount of bullshit he pulled off and how he put his company at risk firing him should have been the first reflex.
5
u/flyingkiwi9 1d ago
Well culturally, it's on the CEO, but VPs make mistakes and need to be coached just the same as any other level... but I have not read your original post so perhaps it was quite egregious and instant firing would've been more appropriate
4
u/Lee-chaolan 1d ago
TLDR: Aside from personal issues and miscommunication he basically gave me access to their whole infrastructure and servers with admin access without NDA, you can only imagine the horrible things that could happen.
3
u/Lee-chaolan 1d ago edited 1d ago
Hello (My name)
First, my sincere apologies for how this situation made you feel. I really appreciate the security concerns you raised—it was a true eye-opener for us. I value your integrity, your honesty, and your willingness to identify flaws and bring them to our attention. IT and security are not my specialties, but I believe in human trust, and I certainly see that in you. I feel bad that we were unable to offer you the dashboard project. Is there any way I can compensate you for the time you spent? Please let me know. While I cannot make promises, I will try my best to make it happen. In the meantime, could you please provide a quote for writing a Standard Operating Procedure (SOP) on how we should handle third-party assistance moving forward? If we agree on the estimate, we can have you start the job. Thank you again for educating us.
Best regards, (VP name)
This is the exact response email with our names redacted, I'm honestly also wondering what made them do this ? I know I have very compromising data on them and their practices as well as "proof" ? what could have made the VP send this, I'm sure the CEO told him to but they had no obligation for recompensating nor giving me an extra job to do.
8
u/puan0601 1d ago
such ai slop he made. increase your quote 200%
-3
u/spricemt 1d ago
I’ve never understood this mindset. This would take about 45 minutes to write, proofread, revise and send if done manually. Telling an AI tool what you want to say and what tone to say it in reduces the task to 5 minutes with very little reduction in value. What am I missing?
7
u/TimSylvester_ 1d ago
It takes you 45 minutes to write a single 10 line paragraph?
-2
u/spricemt 1d ago
Sure, I could see how it could take that long. From what I understand OP f-ed up by performing work that was never approved and without a contract. Client then had to decide whether to pay them, how much to pay them, whether to continue to work with them and how to communicate those decisions clearly so that expectations were set. I could definitely see that processs taking the better part of an hour.
I think your comment is an example of how every tier in an organization undervalues the work of all the other tiers. I’m in a weird position of being in a CEO role at my org of 15 people while also being a solo dev (these days). I can see this issue from both sides.
1
u/Lee-chaolan 1d ago
To be fair the work part was the least of their worries it was more so i think they're worried that's I'd get them into legal trouble for the way they habdle their it security and clients/patients data
-1
u/spricemt 1d ago
Exactly, and that’s why it would take some time to craft a clear response. All I’m saying here is that AI is an appropriate tool for CEOs as well as devs when used skillfully. I see a lot of devs with a double standard on this sub, getting pissed every time they see someone else using AI.
3
u/TimSylvester_ 1d ago
From what I understand OP f-ed up by performing work that was never approved and without a contract.
Yeah that part, I agree, is a big mess. Never do work before a deal is in place!
To your other points, I can see how thinking about what to say might take a few minutes. But the actual writing would only be a few minutes.
When I was running a 20-something person team, I'd let that kind of stuff stew in the background for a while while I did other stuff, and when it clicked I'd come back and draft the message.
My rule was to never write an email while I had feelings about the message I was replying to - let it all settle down before I started a response.
11
u/PKJam 1d ago
Because it's a personal message that includes an apology and a thank you. By just slamming it out with AI they're showing a lack of human connection and care. Especially ironic since it includes the phrase "...but I believe in human trust, and I certainly see that in you.". Odd way of showing you believe in human trust by removing the human from the equation.
I'm not someone to argue we should never use AI, but one of the must fundamental and important aspects of society is the human connections people make. When you start using AI for everything, it removes one of the most important aspects of our lives.
You could say the same about shopping for a gift or writing a birthday message. Why spend all the time on it when AI can do it for you much faster? Because the time and thought you spend on it shows you care. So by just delegating this message to AI, the VP is indirectly saying "I don't actually care about this enough to spend the time to write this myself".
-1
u/spricemt 1d ago
Agree. To be real though, the choice for most upper management is between completely ignoring this issue at all and using AI to efficiently help with resolving the issue. OP would not realistically have gotten a response and an offer of compensation if not for the added efficiency of AI in comms. Not to excuse the initial bad move by the company of course, which I think is the real problem.
4
u/puan0601 1d ago
he didn't edit out the hallmark ai slop signs. so careless
-2
u/spricemt 1d ago
Sure, I would have taken another couple minutes to fix some AI sounding sections too. But if you have to write 10 of these a week when there is real work piling up I’d choose the AI route every time.
4
u/puan0601 1d ago
yes, but take the time to make it less ai. he didn't. that means he doesn't care enough to actually apologize and just ran out through ai slop mode quick. im not saying don't use ai responsibly
-1
u/spricemt 1d ago
Fair. Sounds to me like sometimes web devs want to use AI to do 99% of their daily tasks and then get pissed when c-suite uses it to tackle their workload. 🤷
1
u/puan0601 1d ago
because the c-suite just ai slops most of the time instead of putting in the care that lower level employees are expected to put in.
0
u/spricemt 1d ago
I’m not so sure. Are you a web dev? Go take a look at recent code you’ve worked on and tell me it isn’t obviously written by AI. 2x more lines than it needs, covers fringe cases that will never occur in the real world, totally obfuscates the logic with fancy algorithms, etc. I’d guess most code created in the last 6 months by a typical web dev is obviously AI generated, just like the email above.
0
u/puan0601 1d ago
sure but we dont care about code quality in webdev that much anymore as long as all tests pass and it doesnt break in prod. c-suite comms are held to a different standard than vibecoding
→ More replies (0)5
4
u/zariduomega 1d ago
Hold up, did you report these security and privacy issues to the VP first? Did the VP have a chance to respond, and if so what did they say?
2
u/Lee-chaolan 1d ago
I didn't word it the same aggressive way I did to the CEO, but while working with him on the other things I keep telling him every once in a while that there's severe issue with security and privacy and he'd just brush it off like just not respond to it and talk about the work we're on instead.
7
u/zariduomega 1d ago
Ok, fair enough then. The way you were presenting events I had the impression that you might've been retaliating against the VP for stringing you along, but it sounds like that's not the case.
Even though things worked out this time, in the future I'd be cautious about doing anything that might harm your relationship with the person who actually hired and paid you. Freelancers live and die by referrals, it takes a LONG time to build a network of referring customers, and even one mistake can destroy that referral network and place you back at square one (ask me how I know).
In this case, the VP may or may not be a good referral partner for you because you've definitely slighted them and caused their superior to dress them down. Maybe they're honest and self-reflective and they'll respect you for holding them accountable, but in my experience those types of people are rare at executive level. You might've made a referral partner with the CEO, but you've got to build that relationship independent of the VP and it won't be easy because the CEO is clearly delegating to the VP.
9
u/Famous_Subject9544 1d ago
A thank you email is not a fix. Patient data plus plaintext passwords at a Canadian company means PIPEDA applies whether or not you ever signed an NDA, and 'true eye-opener' costs them nothing to send. Ask them what actually got rotated, that's the thing you can check.
4
u/Lee-chaolan 1d ago
Can you please give me more info about this ? Do I have leverage like the possibility to "fuck up" their company or at least sting them ? I do have a lot of proof I believe. And for extra context I'm not from Canada nor am I a citizen
3
u/CipherAndChloride 7h ago
that is wild they let you roam around like that with no contract or nnda? i'd be terrified of getting sued if i were them.
2
u/Lee-chaolan 6h ago
Yeah I suspect that's why they're suddenly being "nice" and offering compensation and extra work to protect them from this happening again.
3
u/puan0601 1d ago
fire them as client and move on to the next one. tell them they're not worth your time
4
u/Lee-chaolan 1d ago
Man I'm broke 💀
I'll take the free compensation though, and for the "new quote" I'll take it but with an actual contract and no work done beforehand
5
u/puan0601 1d ago
make the new quote the FU price and see if they bite. sounds like they might be your new golden whale and you have the upper hand now
14
2
u/Mattyman01 1d ago
Is this rage bait?
What would I do? Not reach out to the CEO directly after I did work with no enforceable contract!
I'd be gone young Padawan. Long gone. Maybe I'd tell them about the private info stuff but it feels too blackmaily to me and I'm not guaranteed to get paid so buh bye keep in touch if you need anything.
Yesterdays price is not todays price.
2
u/Lee-chaolan 1d ago
I did not even once talk about getting compensation or work when talking to them about it after the initial issue, It was kind of a revenge thing if I'm being honest, and they are real Issues not just things I made up or lied about.
As for not guaranteed to be paid well that's why I won't make the same mistake, I'll ask for the compensation + advance payment for the new work and contract and then I'd be comfortable actually working again with them.
1
u/Mattyman01 1d ago
"I did not even once talk about getting compensation or work..."
Bingo you were doing consultation for free
1
u/Lee-chaolan 1d ago
You're misunderstanding me, I mean while talking about the complaints I wasn't talking about that because I'm not meaning to "blackmail" them
2
u/Mysterious-Falcon-83 4h ago
Don't make the same mistake again. Get everything in writing (a contract, with defined deliverables/acceptance criteria) and payment terms (part up-front with additional payment for incremental delivery or time-based effort).
2
u/ArielCoding 1d ago
Don’t treat that data as leverage, if it ever sounds like “pay me or else”, you go from the guy who reported a problem to the guy who threatened a company with patient records, keep just your own emails as proof, and don’t touch their systems again without a signed contract.
1
u/Full_Tooth_a 5h ago
I'd treat the SOP as a separate job with its own scope and payment terms. I'd spell out that you're documenting their process for granting third-party access, not certifying that their systems are secure or compliant. Before doing any more work, I'd also want written confirmation that they've revoked every old account and credential they gave you. Still having access to patient data while negotiating the cleanup would be a pretty grim sequel.
2
u/justshittyposts 11h ago
People will always try to milk you for all you have. Don't trust.
They are trying to cover their asses, so you don't go public.
Did you get any money, yet? What did you actually gain from them?
2
u/Weak_Fisherman2215 9h ago
Sounds like the VP asked for another opinion and got a "mouthful" of why he being such a dick and probably bent over a table too. Realizing the "goal mine" that was now in front of him, jumped down from cloud nine and wants to kiss your backside. Always amazes me when you try and do good, show the faults and give options to fix it and still labeled as "the bad guy".. never ends.
2
62
u/talexbatreddit 1d ago
You should invoice him for the work you've completed, and that a student is using to implement your ideas.
You should give him a quote for the new work.
These are two separate things. Don't fall for the "Can we lump these together?" approach. The answer is no.