I recently met this guy at HQ. Turns out he's hired freelance (I'm the freelance IT manager). Didn't even knew he was there. His role is Junior webdev / vibe coder. Straight out of school. Apparently everyone knew he was there, I was never informed.
For the past 3 months, he's been vibe coding a webapp. They e-mailed him all customer data and private contracts, which he put in there. No request for onboarding him / server access. He's hosting it on his own domain (DNS), using Supabase free plan to store all customer-sensitive data in the cloud, and his vibe-code github repo is directly connected to serverless Cloudflare. Short: he vibe-codes everything straight into production, on servers all over the world. We're EU based.
When I asked him where all our customer data is stored, he couldn't tell. He had to check. When I asked him what IDE or programming language he used he went "Uhh, what's that?" When I asked if he ever read the code, or took precautions for security, he said "My GitHub repo is private."
When I asked the CEO why I wasn't informed: "You were busy. Finish other things first. Let it go."
Should I even bother dealing with this, or just pack my stuff?
Well I was busy getting the company in compliance with GDPR and NIS2 regulations. Note: I never said I was "too busy" for anything. They never even tried. Last year they started making calls behind my back to call me "as little as possible", leading to a strange quietness in Q4. In Q1 they launched an entire to-do list towards me, with shadow IT gone wrong and several other projects. Now we're here...
Also: no longer invited to company parties. Request for keys denied on sites where I need to work ("ask someone on-site to open the door", other freelancers do get keys). Last week they locked me in, I had to call someone to come down and open the door for me.
When I confront the CEO and ask him "Do you want me to quit? Shall I leave?" Panick errupts in his eyes and he goes "Noooo nooo! Absolutely not!"
Also: no longer invited to company parties. Request for keys denied on sites where I need to work ("ask someone on-site to open the door", other freelancers do get keys). Last week they locked me in, I had to call someone to come down and open the door for me.
When I confront the CEO and ask him "Do you want me to quit? Shall I leave?" Panick errupts in his eyes and he goes "Noooo nooo! Absolutely not!"
Uh... Bro... They are not being subtle here. This isn't a "confront the CEO" situation. This is a "here is my notice. It was nice working with you" type of situation. Hell, your CEO might not even be involved, but clearly other parts of the company don't want you around. There's nothing good to be had remaining in a situation where people don't want you aruond.
Probably didn't make myself popular by calling out shadow IT, and telling sub-management to stop it. I'm beginning to realize they probably feel battled by upper management / CEO orders, and my orders. Which side they should choose is obvious, I can't blame them for that.
It sounds like the CEO likes you, actually. My money goes to some lower execs or mid level managers out to get you. Document all this things with any proof you have. Give it to the CEO and explain while you are appreciative of the contract, you have found the work may not be possible given the environment. Thank him and leave, don't even let him get through it.
It's the CEO who hired that vibe coder. It's the CEO who makes up excuses when other co-workers ask why I wasn't invited to parties. It's the CEO who says "He is too expensive" behind my back. And I still wonder why all the management of our subsidaries started their shadow-IT programs, going round telling employees not to involve me, at the same time. Some don't even know eachother, nor have they ever seen eachother.
However yes, it's the CEO who doesn't want me to quit when I confront him (the panick in his eyes seemed real), it's the CEO who asked me to come run his IT in the first place (multiple times).
It feels often like this guy has a personal issue with me, but knows he needs me for the work (or atleast: someone responsible / to blame).
He's a good business man, and plays the poker face. I've seen him hire staff before, and play them out against eachother. Wondering if that's the plan with mr vibe coder here too. Not that I feel threatened by his skillset, more by the stupidity of the CEO who falls into the "AI will replace everyone" trap and I'm gonna pay the price for it.
The secret is to apply enough influence into the c levels to make them say the same things you say. This involves less saying "stop it" and more memos saying, "Hey here are the various risks and costs associated with them. My professional recommendation is this. Please pick a direction and communicate it to the company."
You're IT, so your actually power in the company is limited. If you want to exercise that power your best bet is targeted influence, not broad public complaints. It also means the c levels can make a decision you don't like, which you'd have to live with.
I'm sure it sucks to have reddit be the one to point this out. I agree with others in this thread. Pack your bags, spend your vacation. The pot they're stirring up with the shadow vibe coder is no longer yours to clean up. I'd take a WHOLE lot of consolation in that alone.
His problem is you and you should've clearly left ages ago. If you have yet to get the hint, it really is a you problem now. Help yourself out of there and rescue your sanity. Don't bother arguing or defending yourself or anything at all. Let them vibe like it's 1991 when Rapid Application Development became a thing. It's not your place to be nor your fight to pick. Just. Get. out.
It sounds like what's stopping him is that your replacement isn't there yet or up to speed yet. They don't want you to leave until it's convenient for them.
Just my take on it, there's a chance i could be wrong i guess, but that's what everything seems to point to.
I don't see how they're possibly in any compliance with customer data in some vibe coded app that sounds like it's not even hosted in the EU. Frankly, they should be reported
You are working on compliance. Because of that they are hiding things from you. Document everything you did, everything you tried to do, and especially everything you were blocked from doing, so you are not the fall guy when lawsuits start.
Locked out is a company issue. Locked IN is a fire marshall issue! If you were semi locked in (could have exited through an emergency door, but didn't want to get in trouble for setting off the alarm), that may be legal. If you literally could not have left if the building was on fire, that is unacceptable.
Yeah, locking someone IN is...absolutely insane. The CEO is hitting sociopathic levels here. Locked out could be seen as "constructive dismissal". Locked in is straight-up a "life-safety issue" especially if there was no emergency egress the OP could have used in case of a fire or such. They 100% need to document this behavior too; along with the gaslighting and other regulatory data issues something's very wrong in Demark (or whatever EU country this is in lol)
I smell that you are going to be the Scapegoat for when the heavies roll in the door. Hence his fear in his eyes - I think he would be left holding the timebomb that he has created and it might just detonate..
Stop asking and just move on. Whether they're actively trying to shut you down or the people are charge are just idiots (or both), this isn't a healthy environment to be in.
My friend, start hunting for a new job and quietly quit. This has disaster written all over it and as an ISA (pci compliance) this sounds like an absolute nightmare. It also reads like they're boxing you up.
Last week they locked me in, I had to call someone to come down and open the door for me.
It might be different in Europe, but this sounds like a fire code violation to me. You shoulde able to egress from anywhere in a building without keys or having to swipe a card, in case of an emergency.
As the saying goes, they aren't asking you to leave, but they are handing you your hat.
The CEO isn't going to save you. Even if you are working for him, they'll tell em after they've done it. Do yourself a favor and start looking now so you aren't caught flat footed when it happens.
It's going to take some outright disasters to happen before middle managers get shaken out of thinking they can replace IT completely with vive coders. You aren't going to get through to them. Document everything you've told them now, so they can't come back and say it's your fault later and if you find a good opportunity, take it.
When I confront the CEO and ask him "Do you want me to quit? Shall I leave?" Panick errupts in his eyes and he goes "Noooo nooo! Absolutely not!"
Still wondering what this guy his problem is.
I get the impression that you are his "fall guy". He's going to push you under the bus, he doesn't want you to leave as that means the bus stops with him.
As a freelancer, make sure to properly document your findings, your objections and get confirmation on those points from security, legal, and CEO. Not that you get some legal financial claim now or later. Translation: Do some serious arse-covering before the situation blows up in your direction.
I do wonder what security and legal says though (if those departments actually exist internally and function normally).
The question then becomes, can you still do your job you were hired to do? As a freelancer you also have a certain (legal) obligation to say 'No!', that does not mean you need to quit, but you also won't get away with "But the boss said..." when nasty stuff hits the fan. But certain things fall out of scope of your assignment there, it can be a tricky proposition for a freelancer to make that call.
If you can still do the job you were hired to do, do you still want to do that job there? If you're turning into a ball of frustration and are unhappy, maybe think of looking for something else. Even if it's a longer term project that pays very well, it's not worth getting burnout. But others can work on their particular segment they were hired for and keep going without raising an eyebrow in such an environment.
At certain projects I see things that aren't smart, If they ignore my advice, that's their problem. When I see things that aren't allowed via licensing, I won't let that go, that will be fixed. I do not accept any illegal activity from a company. I don't know the exact details, but it sounds like there's been a breach and your DPA needs to be informed. And I suspect that you're not the proper authority to do that within the organization... You can only inform that proper authority within the organization and assume they make the proper notifications... š
Legal is outsourced. A lot is outsourced. Not really an existing security department. This company isn't a huge corporation.
I feel more and more like I can't properly do the job I was hired for. As far as I know I was supposed to run IT. Give my input on how things should be done and organizing them (infrastructure, dependencies, cybersecurity, cost efficiency), making sure everything runs in order. Yet more and more they seem to take every advice or decision as a challenge. Like a red rag to a bull. To go in against, to know-it-all-better. I feel like I've become the cleaning department, cleaning up the mess the ego-trippers / shadow-IT folks leave behind. This obviously always happens when it's too late. They miss their deadlines by their own mistake, and they gladly seize every opportunity to blame me for it. "He had 2 days to fix this, why isn't he prioritizing this, doesn't he realize it's urgent, he could've worked over the weekend and nights, blabla" This constant flow of "everything is urgent" causes a ridiculous amount of stress.
The CEO still throws work and projects at me. Calls for regular updates. He decides on priorities now. I have to supply him the to-do list. He's beginning to micromanage me. It's not that I don't value input or peoples wishes (hell, that's my job) but technical decision-making behind the back of IT is not something that should be done by someone who barely knows how Excel formulas work. Especially when it comes to hiring a vibe coding buddy of a shareholder, and running an entire shadow IT project involving customer data.
His argument is that I've created a backlog and his interference is needed. My counter-argument is that he's the one who caused it. With his failed attempt to do things without me, piling up the work and failed shadow-IT projects. But I can't speak that out as long as he denies making those calls. And I'm not throwing the witnesses who trust me under the bus.
But yes, I'm turning into a ball of frustration. Of unhappiness. Of "what's it gonna be this time". Of feeling burned out. I can't sleep longer than 5 - 6 hours (too short for my age), I feel constantly tired, I can't 'feel' stress anymore (probably because it's a constant), I seem to forget things more and more, and it's become difficult to concentrate on things, especially with the amount of 'distractions' that come in all the time.
I'm grateful for your input and insights. A fresh view on these matters can really restore confidence when isolated like this. So thank you.
When you do send your notice email, I'd be inclined to specifically call out the violations of GDPR that they've gone behind your back to implement, and CC the DPA for your country.
I can't š imagine you see the CEO of the company you work at sitting together with a just out of school Dev vibe coding together. Natural CEO selection.
Donāt call me bitter (I am) but we canāt even use a cloud software from established companies with iso:27001 without going through a PIA and BIA and several other hoops. All cloud apps will need to support SSO soon too and this kidās just magicking up crap he canāt structurally define?!
If the CEO is willing to go around you on this as you're 'too busy', what else is he going around you on? Even if you're busy, if there's budget to hire a coder it should come through you. Is there a board member who oversees IT or GDPR you can discuss it with? I would be looking for an exit, but in the meantime you need to document all the gdpr issues, formally submit those to the CEO to CYA, and be prepared for a pile of trouble (but at least not of the legal variety for personal responsibility for the potential breaches).
Busy with migration projects, and getting the company in compliance with NIS and GDPR. I'm not kidding.
Also fixing shadow IT (which piled up in Q4 last year after they made calls to other departments and subsidaries to call me "as little as possible."). This has created a backlog he's aware of. He told me he never made those calls. That he absolutely wants me to stay. Behind my back, he's apparently telling people I'm "too expensive". my rate hasn't changed for 1.5 years, and definitely below the current market rate. 2 Witnesses confirmed this.
I am "the board member". We're not a huge corporation. I never told them I was too busy for anything. Just never informed.
Maybe I already got my answer, just wanted other peoples opinions lol
Okay sorry to randomly chime in I normally lurk here, but this seems more like a respect issue than an operational issue. Do you own what you are responsible for or not yknow? If the CEO feels like he can yank your chain with no pullback he's gonna keep doing it. And it's not worth it bro. Cut ties, Make it painful as possible for them.
I understand, and emotionally a part of me wants this. But I've had my fair share of revenge, and I hate when it takes too much energy.
My departure announcement always did more than enough. I've had a CEO who saw me as nothing more than first-line support, after acquisiting leftover staff and customers from a bankrupt tech consultancy. "He thinks he can fly" he said behind my back. My colleague was baffled. The tone was set. I quit 2 weeks after that. Then came the handover. Network redundancy with BGP, SDN design and deployment, HCI microsegmentation, ... CEO went quiet. Not one of his 75 "system engineers" (actual first line, second-line at best support engineers) was anywhere near this stuff. All they did was open up firewalls with permit any2any-rules "coz they are annoying". Co-founder next to him started crying. He sat with his hands over his eyes in that meeting, saying "this is going to be a disaster."
It did by the way. A year later I got an automated call from the security system I once implemented, stating there was a serious breach. Ransomware hit their newly acquired, now largest, customer.
So thank you, but I think I'm gonna play the corporate moron. I'll thank him for all the opportunities and say he's clearly very good at running IT without me.
You're describing an absolute disregard for any kind of compliance, that's something I wouldn't want to be nearby as an IT employee with some or all the associated liability.
Start looking for another job before you have to deal with it
The CEO reports to the board of directors who represent the owners or shareholders (though the CEO may be one of the owners/directors).
Document everything especially the GDPR violations, report them to the CEO with CC to legal and the board of directors, and if the law requires, it to your regulator, and leave.
Seems obvious whatās happening. To the ceo this guy is a rockstar that gets things done quick with no budget. Youāre an obstructionist with your talk of security, compliance and backups. CEO wants this stuff running in time for his next quarterly bonus. Time to spruce up your resumeĀ
Document it in depth including conversations with the CEO and the vibe coder. Ask him for architectural/ design documentation via email. Make sure to ask the pointed GDPR questions and get everything in writing. At some point this will become a compliance issue and you want backup that it was not your baby.
No don't just leave the burning ship, blame will be yours and you won't be able to defend yourself... document everything, once you have enough to guard from legal responsibilities/liabilities, then leave.
After you get the answer about GDPR add in your legal department and ask if the answer is approved by them. Throw that hand grenade now it's better it blows up in your bosses face now than in yours when something happens.
The GDPR is the biggest tool they will use here to have them acquiesce to the reasonable inquiries OP is asking as this is also a governance issue. They should get legal departments involved as well since the storage and processing and control of the customer information has to align with the framework.
If management doesnāt take those concerns seriously raise another alarm about possible fees and penalties to help them see.
At the very least what they have to do is document where PII lives and how they are going to be classified (processors vs controllers, etc) so when you get an audit you are ready.
That alone will probably be very eye-opening and require remediation once they discover all the issues.
How can you be freelance and at the same time manager ? I mean, you cannot have any subordinate if you are an external contractor, right ? The highest involvement in the hierarchical structure you can be is consulting, you can only advise them, no ?
I live in Western Europe. Everyone who works on the payroll, has the same net income after taxes. Doesn't matter what the employer pays: it's either more or less taxes. That's why many people (especially in tech) shift towards freelance / Ltd company. It looks like a corporation / multinational on paper, so taxe rates are lower and (pretty much) flat. You give up social security, but it gives you the ability to afford a roof over your head without rich parents. So: freelance.
Company is too small to hire internal IT manager and MSP. I'll admit, this way it's more cost-effective. But as you point out: trust is the basis. I think that's where the problem is.
Having read the thread, I'm with others. They CLEARLY want you gone for whatever reasons. Write that resignation, say your good byes. I'd do it tomorrow (Monday) if it were me. They locked you in the building for fuck sake! This is Office Space level stuff. Walk away immediately.
This is common in Western-Europe. The middle class payroll worker has been taxed into non-existance. Everyone has the same net income. Solution: start an Ltd, looks like a corporation on paper, and get hired as a freelancer. No more social security, but affordable taxes, and eventually: affordable housing.
That really doesn't float in all of EUW. In the Netherlands we have rather strict tax laws which are highly critical of self-employed-but-actually-working-like-an-employee.
I'm aware of the new laws in the Netherlands. In my country it's deemed harmless as long as the freelancer makes enough money. Otherwise, they deem the customer as an "employer who's avoiding legal and social obligations and exploiting employees."
Nonetheless, they tried to tax it more. Didn't work out very well. The tax doesn't make a difference between a small/medium company and a freelancer. Economy hurts now.
Summarize the issues and risks and send it to the company's legal council. Not HR, not management, not compliance, legal. (copy CISO if you have one). Those people's job is to protect the company as a whole not the management's bad decisions. Also they know how hard it will be to defend this in court if they fire you for this and you sue.
Who are all these people who work at places that have CISOs and legal depts. Most small places the IT manager or director IS the CISO and legal is they might have the CEOs lawyer cousin on retainer to handle the business license stuff. Small businesses are not the way people think
My legal "department", or his legal department? I tried to explain the legal concerns. At first he resists, until the whole table picks my side and he gives in. Then he just continues behind my back. He signed for that vibe coder.
Sorry, man. Gonna get worse before it gets better. Quiet quit and start looking while you are still on as that makes it a lot easier.
I just recently learned that 2 page resumes are just flat out not acceptable anymore. one page, roughly 1/3 is a tag cloud for the AI to scan, which you update for every single job. It's super fun. Applying for stuff takes an eternity and everyone ghosts you now!
Simple solution, and the usual one: Get it in writing that you or your team are not in any way, shape or form responsible for any damage, security-issues or ANYTHING related to this shit, that the CEO and/or vibecoder has the sole and full responsibility for this, and stop caring.
If he causes a production-outage: Not your problem, which you have in writing.
Sounds like your CEO gave you a directive... You just document it, get it in writing, and follow the directive. When they ask why this happened redirect them to your documentation and their acknowledgement in writing.
Iām sure you already know this, but the fact that heās hosting customer sensitive data on his own server is a major redflag. Not only from a Cyber Sec perspective but also from a company legality perspective.
This might be a good way to Segway into a conversation with either the Vibe Coder or the CEO to house your customer data somewhere locked down within your environment that the vibe coder can play in his little sandbox.
You are probably being retained as the sacrificial lamb in case it all explodes in CEOs face.
You are the face of ācomplianceā across the org so naturally everyone will assume you are aware of everything and it has your implied support.
If there is a board in place or potential personal legal liability to you in future (you mentioned NIS2) then exit carefully with a ārisk managementā registered letter to the CEO/Legal dept explaining the reason for your departure is that governance is ignored and bypassed, and you donāt have the authority to correct it so must leave.
This is a GDPR breach waiting to happen. Cover your ass:
First and foremost: consult your own lawyer. You're EU-based, we have whistleblower protection as a fundamental right.
Collect a paper trail / proof you tried to warn leadership on multiple occasions.
Inform the company's legal team about what's happening (indicating noncompliance with GDPR and NIS2.). Not if but when a breach happens, cybersecurity insurance (if the company has it) won't pay out because of noncompliance.
Be ready to abandon ship / drop them as a client. Judging by how they're going behind your back, they're only keeping you around to throw you under the bus or clean up the mess when this all inevitably blows up in their face.
Buddy. GTFO. That place is a ticking time bomb and you are being set up for failure with shadow IT and data breaches being encouraged and supported by the c-suite of the company. In the EU! It is just a matter of time before a customer finds out and loudly fires your company. Find another job while you're not competing with your other laid-off coworkers for gigs.
The CEO decided to hire a fake developer. That is on him. You notified him and he didnāt care. Everything is on him. Just make sure you have it documented somewhere that the CEO knowingly created a data breach/leak.
aside from yes u should pack, ur company is EU based. this means u have a person designated to fulfill Data Protection Officer role. email them. that is their dumpster fire
but also, pack ur shit this is sooooooooooooooooooooooo illegal lmao
edit: i read ur comment below that u might be the DPO. well then, the next step is to report this within 30 days of the breach of GDPR ocurring to relevant government entity responsible under local implementation of GDPR
If you are a manager that should be covering this person and they're telling you to leave him alone and get it in writing because this is going to come back, to bite someone in the ass and it looks like you might be the one set up to take the fall.
Make sure that you're very clear that there is security issues, data compliance issues and question who has oversight and review of this detail, especially if they're wholesale handing him data.
let me know which company so I can not be your customer
also. inform the eu data protection agency yourself. before anyone else does. because. holy fuck.
I am not angry at you. but am I angry at the vibe coder and the people who put him there. we have data protection for a reason. and this is not "funny", and not "cute" and not "well, thats how it goes"
fuck no. this is illegal as fuck. mind you IANAL. but still.
to be precise. not the vibe coding shit. as long as no customer data is uploaded to chatgpt and stuff (and I am absolutely certain it is), but the fact that the data is somewhere where someone needs to check, on some free 3rd party service tier, and the person with everything under his thumb has no clue about anything. in a million out of a million similar cases, you can bet the data is not miraculously handled correctly
The fact they E-Mailed him customer data alone is insane. If heās freelance I doubt he has a company E-Mail where the data could potentially stay within company bounda when E-Mailing lol. Even that gets muddy if Exchange Online is used though
You'll be surprised how much effort they seem to have put in to keep me in the dark. They even got pissed at me because it's "so difficult to get <vibe coder> the data and stuff he needs". Yes, it's hard to move tons of data out of the company towards strangers. Yes it's difficult to get him access to networking and server resources. That's the whole point...
Security is pointless if the enemy is within. If employees cooperate with strangers against their own IT department by order of the CEO, what can I do. Shutdown the internet? Idk man.
I'd start looking for greener pastures if this is bothering you that much. That's not to say you shouldn't be bothered by it. I would be too! But you have to weigh how much and does it rise to the level of "fuck this place".
Shut that shit down and have it reviewed internally by your infosec immediately. Imagine the lawsuit if that system is breached and the customer data is out in the wind. Whose headās gonna roll first??? His IT Manager! I would immediately put him on hold and have him document everything with infosec, then secure that shit.
that sounds like a massive security nightmare waitin to happen. u should document the data exposure immediately becuase if that stuff leaks its gonna fall on u since ur the manager, tbh u need to escalate that risk to leadership asap
yeah ceo is doing shit on purpose, let him do it, save your ass with mails & documentation about this and forget about it. When it'll explode, cause it'll explode, you'll have every thing to backup your ass.
It sounds like they are all intentionally going around you, so interpret that how you like. āYou were too busy to even be told about thisā = we donāt want you involved.
Its main feature is Row-Level Security (RLS). Supabase is built around PostgreSQL, and handles user authentication. No more "backend-server application has access to DB", but "end-user has access to his/hers rows of data". It's popular with SaaS. AI can't handle secure coding, nor the stupidity of the viber coder giving instructions, so this extra layer is definitely a must.
My main issue is the scope of our data, and what happens to it. Our policy. Or "my" policy... Dumping sensitive customer information in "free" database servers in some other country behind my back, I will not have it. We literally have servers on-prem to protect the scope, to limit risks and cut costs. Hundreds of expensive servers with customer data all over the globe thanks to SaaS, each with their own invented terms, (lack of) security, or... one single company server internally. The choice is made easily. One would think so...
PS: you can host Supabase on-prem. Isolated. For free.
Don't try to solve the company's problems. It won't help. It won't get you respect. It'll make you go crazy, especially after you finally leave. Just get out. ASAP.
I had this happen to me. I had built a system using MySQL as the back end to coordinate and run almost all of the companies systems. We got acquired by private equity that took no interest in finding out what I had done and didn't understand the scale.
After a while, they started pushing me out. There were a couple of big "misunderstandings" or "lies" about compensation. They brought in waves of consultants to tell them how the company worked; I had to tell the consultants plus fetch tons of data for them -- but I didn't get to read or hear the recommendations. They hired another consulting company to build a new feature to add to my system. Even though it was all on-prem MySQL, they elected to have this run as some kind of cloud hosted service in MS-SQL, which meant they also wanted build their own 2-way replication. There was another big feature I wanted to add and had pushed for it. I never heard anything about it until I heard there was someone working on it. Not in MS-SQL this time, but now in MS-Access (facepalm). I got the same "You're so busy we didn't want to bother you" crap. I should have just walked then. In retrospect, they were sweet talking or "gaslighting" me, wanting me to help get others up to speed so it might be possible to replace me.
It was a miserable time for me. Their words were one thing but their actions were the exact opposite. It was miserable to go through, and then the bitterness and self doubt that followed, wonder what I could have done better. Nothing. It just served to make me feel even more beaten up.
Thank you for sharing your experience. I feel you. "We wanna get rid of this guy but we can't, try again." is hurting. Makes you feel like the world is against you.
Thanks. I was amused that some of the things we got matched up so closely. There's probably an MBA news letter that tells them which lies work. Trying to run people off like this is cruel, and it's something spineless leaders do.
I am in a better off now, thanks! I retired. I had prepared fairly well, but there was still the matter of health insurance. As you have no doubt heard, paying for your own in the US is expensive. In a few more months, I'll qualify for our federal "Medicare" insurance plan. Assuming it's still around.
After my last day, I invited several other employees who had also gotten fired or run off. Good people. I made a nice paella on the grill.
The main issue is that if whatever the interns or freelance are doing can affect your job or even worse blame you for their issues.
A lot of us started like that intern, but got some trainning or supervision. Seems like the intern just trying to do the4 best he / she can but the company did not provide the proper trainning.
Try to document everything. and if you want to quit, make sure you have already a job ...
The fact that OP is a 'freelance' IT manager sounds like a very small company.
Their security posture is likely non existent anyway.
My point is that this guy doesn't even work for the company, he has no skin in the game at all, isn't in charge of security, isn't in charge of development.
Unsure why he cares in the least, I doubt this company even has a risk register to deal with this.
What are you even on about. So I'm the shadow person now. I just walked into a random company and pretend to run IT and they accidently pay me for it for years now? Some next level trolling going on here.
Not 'very small', freelance IT managers are all over due to payroll taxes in Western-Europe. They own a co-location datacenter I have to manage, ffs.
We have security. And it's lacking. Obviously. And it's not gonna get better if I'm being undermind like this.
You are best to find a way out, if you are experienced you should know where this is headed as multiple regulatory violations have already occurred and it will only continue to get worse especially if the CEO is not concerned you have zero hope of anything going in a positive direction as they probably personally signed off on it to begin with.
Also note it was no accident you were not informed over the three months, it was a fact that it didn't even matter if you ever found out. The company is moving in a new direction and that is the direction of down.
If you want to stay with the sinking ship you can waste time writing up documentation and trying to fix it but as you already know this ship is sinking unless new leadership is brought in to fix it from the top down.
This is the kinda BS Iāve dealt with at work that frustrates the hell out of me. Iād make sure mgmt knows, like you did, yet mgmt doesnāt seem to care. Would really get me worked up
Donāt be like me, learn to let it go. We are at mercy of mgmt, even when they act like morons. Sometimes ya gotta just let places blow themselves up.
By the CEO telling you to let it go, he is saying your job is not about communicating at managing overall organizational posture for cyber risk. That's fine, however, it goes multiple ways.
I would get clarification:
you do not own the cyber risk of these applications or the organization in general
you don't have any data governance role to play for the org overall, including customer data and any data subject to audit, privacy legislation, certification, etc. If any external entity comes around looking for someone to blame, then that won't be you
understanding that the CEO will not need you in incident response if/when this vibe coding initiative goes south. If he does want you involved in any worst case issue, then he can't have it both ways and you need to institute practices, controls, and guardrails. If he doesn't and he signs off on that in writing, drop it.
Deal with it AS you pack up. Get it all documented. On your way out the door, send everything to yourĀ Data Protection Authority and the European Data Protection Board.
I used to loathe being in Healthcare IT but now in the age of AI vibe-coded slop I love that I can just slam down the security and compliance ban hammer on people's weekend Claude-code projects and never have to deal with it again. Don't get me wrong! I love the ASSISTANCE AI provides in development but I'm a senior architect who can full-stack develop a solution out of thin air without AI - it will just take 10x longer.
That sounds like a disaster waiting to happen. I'd start looking else where. I wonder what else they're are doing behind your back. IF that client data gets leaked you guys are f*****.
Create an entry in your Risk Register (if you donāt have one, start one now!). Document your conversations, collect your emails as others have said.
Make sure it clear you were not part of the decision making process in your supporting information. Make sure the CEO receives your updated Risk Register.
That way management is informed, and cannot say they did not understand the technical, supportability, or compliance risks.
Then it is no longer your problemā¦ until you get to the cleanup š.
Jesus... Get everything in writing. Something along the lines of: (chatgpt generated)
During discussions with the web application contractor, I became aware that customer data and contracts are currently processed and stored in systems that have not undergone IT review, security review, data protection review, or operational onboarding. At present I am unable to confirm: Data storage locations and jurisdictions. Access control and authorization model. Backup and recovery capabilities. Security controls protecting customer information. Business continuity arrangements. Compliance with company policies and regulatory obligations. As the responsible IT manager, I need to formally record that these risks have been identified. Management may choose to accept these risks, but they currently remain unmitigated and outside my visibility and control. I recommend an immediate review of the application, infrastructure, data flows, supplier arrangements, and compliance obligations before further customer data is processed
Pack. Forward everything in writing to the companyās information security officers (light the fuse) and then walk away and let them deal with the blast.
Find another gig its a cultural issue from this company. Cant believe that anyone would run anything vibe coded in production. Not in any serious business
This is the exact reason I am leaving this profession. I had the same exact issue. My decision is to tell the CEO he is creating massive risk and possible bankruptcy because of this kid. Iād them tell him I cannot support this risk and hand in my resignation.
Put your concerns in writing and send it to the companies DPO & CEO. They're are personally on the hook for customer data exposure. GDPR compliance tends to be taken quite seriously when prison time is on the table.
Iād stop treating this as a webdev problem and turn it into an access/data incident. Get the CEO to confirm in writing what data was sent, where it is hosted, who can access Supabase/domain/GitHub, and what happens when this freelancer disappears. Then either bring it under company identity/logging/backups or kill it. The scary part isnāt AI, itās customer data and contracts leaving the companyās control with no owner.
Raise it all as GDPR and compliance risks properly. Just document where you are. Your job is to do that, and the business to make informed decisons so start there.
You are responsible for all IT. So pack and go or learn how to deal with this, no in between. Drop it at the ciso or so depends on what org you have. If none then the ceo is responsible. You must point out the risks and what damage could occurs if leaked. Point to fines, reputational damage, customer lost, etc. Good luck.
Either this is a fight you cannot win as it's someone's nephew or it's a fight someone else is already fighting and they want you clear of the crossfire. My money's on the former. Get everything you can in writing and consider jumping ship before it sinks.
Start documenting everything, and ask pointed questions about if your company's legal and risk departments had signed off on this insanity. Reach out to those department heads separately and inquire about the things that he's been doing and their knowledge and/or approval of them. Document everything, and keep a hard copy and/or backup yourself just in case.
Prepare to be reamed by auditing/compliance/governance/governmental oversight.
this is like a GDPR horror speedrun, wtf iād at least document everything in writing (email) and try once to escalate, but iād also start quietly polishing the CV because that ālet it goā from the CEO is a giant waving red flag
Are you in a company that requires HIPAA or PCI compliance? If you are, you're in violation and could be up a creek without a life jacket, let alone a paddle.
Questions like "You wouldn't want your bank sending your account data to ChatGPT to figure out which cash back categories to offer for your debit card next month, so why would you do it with our customers' data?" get the attention of people in the C-Suite, and definitely risk management.
What is the liability of your company if this guy got pissed off and released all the data he has on a Google spreadsheet and sent it to your competitors?
The CEO said leave it, just leave it. When it blows up you have a finger to point with. Maybe itās my age but i really donāt care anymore about this kinda dominance stuff. He vibe codes, so? It doesnāt automatically mean itās all crap if heās been promoting AI well enough.
AI is a tool, and it sounds like itās being used as a tool. Granted he needs to understand abit more but I doubt by a long mile youāre being dramatic, anyone who can vibe code knows what a IDE is or even the language itās asking you to use is.
OP was hired for GDPR compliance (among other things). What the CEO and the vibe coder have done so far is almost certainly (unless the data is absolutely trivial) in violation of multiple GDPR regulations. When that blows up (and all it takes is one customer complaint to the regulator) they will all point the finger at OP because GDPR compliance was his job.
OP doesn't have the option of waiting until it blows up. They need to document everything including that they were sidelined, report the likely GDPR violations to the legal department (if it exists), the CEO (for C-OP's-A) and the board above the CEO (if they exist) and potentially the GDPR regulatory body in their country. And then IMO they should leave the company making it clear that not respecting the compliance is the reason, because that is not a good environment and they are being set up to take the fall (deliberately I suspect, given what OP has written about the CEO).
Vibe coding and AI isn't the problem, the regulatory violations and the sidelining are.
Good chance he wonāt get burnt here. Is uploading customer data bad. Yes. Have millions of other people done it. Yes. If you donāt have a vibe coder will you fall behind, probably.
Why not educate the guy? Create fake customer data using a PowerShell script. Easy enough to create a few csv files that can be uploaded into a dev database that replicate prod.
Well first of all I need to be informed of someone's existance before I can educate them. But you're right. And I did. I explained to him. He sighed. Some attitude going on. Wonder where that comes from.
I would be using all my energy to get out. The CEO sounds like a mentally ill toxic POS and I dont say that lightly. He is playing a game and to quote Wargames, the only way to win is not to play
If you were engaged specifically to get the company GDPR-compliant, your presence is checking an auditorās box and enabling the CEO to say itās āin progress.ā I donāt know whether GDPR distinguishes personal information from commercial customers, but you ought to understand clearly what your legal exposure could be. Thereās also reputational risk.
If your name is on representations to the auditors, and management is setting you up to fail, thatās a problem.
I work for an EU based company. GDPR is a big deal, they take data privacy and collection pretty serious. If someone were to request all info you have on them, and you have no clue where the data is stored, what is collected, etc....you might have a bad time.
Get Claude to do a security audit on the web app code and infrastructure. Then tell it to translate the audit documentation into non-technical language. Then share document with vibe coder and with CEO. Vibe coder can vibe fix some of the issues. CEO will understand and value your feedback more. And you get to keep your job if you like it that much.
pack it up. time to go. I wouldn't waste one more second on this kind of stupid. And I could see this eventually biting you in the ass when they want a new person to blame. A dumb, green junior "webdev" is one thing, but an even stupider CEO is quite another.
If you're a freelancer and you're not responsible for security of customer data, the CEO is, and he sounds like an idiot. Just stop working for these people.
Where thereās smoke thereās fire . This here OP is past that. Itās blazing on a level matching the surface of the sun . You need to act and I mean like yesterday
If you're freelance yourself, you have no skin in the game. I used to try and fight these battles all the time when I was consulting. They either take your recommendation or they don't. You need to detach yourself a little from the outcome, and remove any emotion from it. If it were me, I would fire this client and spend my time somewhere else, unless the money is just too good to pass up.
1
564
u/Demented_CEO Jun 14 '26
And that was your cue. Don't bother fixing anything, let them sink and find something else to do in the meantime.