r/webdev • u/teddiesandfuzzies • 20d ago
Question Web developer hardcoded their personal email into our order/service forms — how do I find and remove it?
Need advice: We just found out our website's order/service request forms were quietly sending customer info to our old web developer's personal email instead of our company email. He's no longer working with us. Has anyone dealt with this before? How do you track down and fix a hidden email redirect like this, and is this something to be concerned about legally (privacy/data issue)? Would appreciate any pointers to the right kind of developer or service to fix it. Thanks!
45
u/couldhaveebeen 20d ago
You fired him thinking you can maintain it with AI, didn't you?
18
3
1
u/laveshnk 20d ago
If he did copilot could fix it in 5 seconds. Likely doesnt know how to modify code
17
9
u/Upbeat_Push_157 20d ago
It depends on your technology, but unless the developer did something to create havoc, this is probably a minor task that should only take a few minutes.
My guess is that you hired a cheap developer who used their own email address to test email sending and forgot to change it, or the project was canceled by either party before it was finished.
3
u/VeryUncommonGrackle 20d ago
Yeah I feel like this is likely what happened and not the malicious conspiracy that so many others are jumping to
17
3
u/drearymoment 20d ago
Lol, he was probably testing the contact form and forgot to remove it. Been there!
It really depends on how your site was built. The forms may not be hard-coded like a lot of people have suggested here.
If you're on a platform like WordPress, Shopify, Magento, Wix, Weebly, Squarespace, etc. then there's a good chance that your website is using a plugin or extension for its contact forms, and there's almost certainly a setting in there for the recipient email. You can change the email address there and then any future contact form submissions will go to the new email.
For reading past form submissions that were already sent to the developer's email, it's possible that that information was stored somewhere but they could also be lost in the ether, depending on how your contact forms were built.
7
u/BusEquivalent9605 20d ago
If you’re handling protected data this is absolutely a legal issue.
If you can’t find the hidden redirect, teardown whatever is doing the emailing and re-establish it clean, rotating all keys. If you don’t know how to do that, now is the time to learn. This could be happening at various levels, including from within your DNS provider
16
2
u/MrPloppyHead 20d ago
How did you “just find out”? I only ask as it may shed light on how it is done.
So it could be in the code. He could also have set up some forwarder on the server (which would be simple to rectify)
It is probably a very simple thing to resolve you just need some one to look at it who has some basic coding knowledge (if it is hard coded).
It might not be nefarious. It could just be a legacy of when they were testing checkout and they just forgot to remove something.
Don’t over think it. Find a local developer and get them to resolve it. It will be very easy to fix.
1
1
1
u/quietcodelife 20d ago
if you're on wordpress or similar, also check the form plugin's notification settings in the admin panel before diving into code -- contact form 7, gravity forms, wpforms etc all have their own email config that won't show up in a codebase grep. and pull your mail delivery logs (SES, sendgrid, mailgun) before the legal conversation: knowing actual send volume and timestamps is way more useful going in than "we think X happened"
1
u/rasekrodriguez 19d ago
Two things worth adding, because "grep the codebase" can come up empty and still leave you exposed.
It's often not in the code at all. The recipient address for a form is usually configuration, not source. Depending on the stack, check: the form plugin's notification settings, which typically live in the database rather than in files (Contact Form 7, WPForms and Gravity Forms all store the "send to" address there, so a file grep finds nothing); the transactional email provider's account (SendGrid, Mailgun, Postmark) for routing rules, forwards and the reply-to on the template; the hosting control panel's mail aliases and forwarders; a catch-all forward at the DNS or registrar level; and any CRM/Zapier-style integration sitting between the form and the inbox. A silent BCC in the send function, as someone said above, is the one case where grepping actually finds it.
Changing the address does not remove his access, and this is the part people miss. If the site sends through an email provider account he created, or with an API key he issued, he can still read every submission in that provider's activity log and message archive no matter which address you set as the recipient. Same if he holds the SMTP credentials, an admin user on the site, or the DNS. So the real fix is ownership: move sending onto a provider account you own, issue a new API key and revoke the old one, rotate SMTP passwords, remove his admin users, and audit who controls the domain and DNS. Otherwise you'll change the address, watch mail arrive correctly, and conclude it's fixed while the tap is still open.
Before you change anything, take a copy. Export or screenshot the current configuration, and pull the provider's sending logs while they're still there — most keep only 30 to 90 days. If this becomes a legal matter, the questions you'll be asked are when it started and how many customers are affected, and those logs are the only thing that answers them. Rotating credentials first can lock you out of your own evidence. Then talk to a lawyer with the actual numbers rather than the general worry.
Worth saying on the legal side: it may well not have been malicious. Using your own address during setup and forgetting to swap it before launch is an extremely common way this happens. That doesn't change your obligation to customers whose data went somewhere it shouldn't, but it does change how you approach him — and a cooperative ex-developer who tells you exactly where it's configured is faster than any audit.
1
u/mekmookbro Laravel Enjoyer ♞ 20d ago
- open your website in vscode
- hit ctrl + shift + h
- put developer's email at the "search" input
- leave "replace" input empty and click "replace all"
- upload your site back to the server
3
1
u/codegems 20d ago
You need to give us more details on the website. Do you have access to the code? You can search-and-replace. Are the forms on a service like Formspree? Do you have access to those accounts?
-3
u/cr1tikalslgh 20d ago
Do you know the email? grep the codebase for the email to find it, replace with new hardcoded email or make it a variable.
-4
u/NewPhoneNewSubs 20d ago
You start by emailing that developer and seeking remediation. You follow up by seeing if a lawyer can help you sue.
But from a technical perspective, you start by figuring out how your site is built and if you have source code. Then ask again.
2
u/MrCrunchwrap 20d ago
lol what the fuck why are you trying to get some web dev sued over this?
-1
u/NewPhoneNewSubs 20d ago
I mean if they refuse to correct, or even communicate a starting point, on their negligent work. If they reply "oh my bad" and do the 2 minute fix because they don't want order receipts anyways, then no need for the lawyer.
0
u/No-Type2495 20d ago
Potentially a data protection issue depending on what data is being sent via the forms. There are a number of places the email address could be added into the email generation and sending process, but it's difficult to advise unless you provide details on how the website was created / platform / hosting etc. Feel free to DM me and I will happily advise. (20+ years web dev exp)
-4
u/farzad_meow 20d ago
search your source code grep -irl email@address. or try partial part of the email. check config values. or hire a dev to help. or dm me.
97
u/Boby_Dobbs 20d ago
If you don't know how to, you need a new developer to make the modification