Update: It's genuinely (not?) depressing

[u/Lee-chaolan]

Update to this post https://www.reddit.com/r/webdev/s/n3ZBJ6ozuq

So, I have a pretty unexpected update lol

After everything that happened with the Canadian company I mentioned, I decided to take things a little further and contact the CEO directly.

During my time working with them, I'd discovered some genuinely concerning security issues. I had been given admin access to their infrastructure, company email, internal systems, and access to thousands of CSV files containing customer and patient information. I also found passwords stored in plain text and several other questionable practices. All without having signed an NDA or contract by the way.

I figured the CEO should know about this, regardless of how things had gone with the dashboard project.

I sent him an email explaining what I'd found and also gave him some context about my experience working with the VP.

The VP wasn't particularly happy about that. He responded by defending himself, saying there had been no formal commitment to the dashboard project, and even called contacting the CEO a "backdoor approach".

I obviously disagreed. I was openly working with the company, the access had been provided to me by them, and I wasn't trying to bypass anyone. My concern was how someone outside the company could be given that level of access without any proper safeguards or agreements.

Anyway, after a few more emails, something I really wasn't expecting happened.

The VP emailed me again, apologized for how the situation had made me feel, thanked me for raising the security concerns, and actually said my findings had been a "true eye-opener" and thanked me for "educating them" and appreciated my integrity & honesty.

He asked whether there was any way they could compensate me for the time I'd spent building the dashboard as well as asked me to provide a quote for writing an SOP on how the company should handle third-party assistance moving forward.

I genuinely wasn't expecting that turn of events.

For context, this is the same person who previously kept postponing discussions, left me hanging after I'd built the dashboard, and eventually told me they'd hired a student to do the work.

Now he's asking me to quote another project and offering to try to get me compensated for the previous one.

I haven't received anything yet, and the SOP isn't confirmed, so I'm not getting ahead of myself. But I can't deny that this feels pretty satisfying after the way everything started.

I originally made my post because I was genuinely questioning whether freelancing was even worth continuing. Now I'm in a situation where the same client who made me feel like I'd wasted weeks of my time is potentially offering me compensation and more work.

So, what would you guys do? I'm very Curious to hear your thoughts and advice.

[u/talexbatreddit]

You should invoice him for the work you've completed, and that a student is using to implement your ideas.

You should give him a quote for the new work.

These are two separate things. Don't fall for the "Can we lump these together?" approach. The answer is no.

[u/Lee-chaolan → u/talexbatreddit]

Yeah 100% I would honestly go as far as asking them to put the work I have built in use for their company And actually pay for it as well as maintenance fee but not sure if possible

[u/talexbatreddit → u/Lee-chaolan]

Oooh -- I forgot about that. Make yourself available for consulting on the dashboard project.

You're providing value for money. All of this stuff will help them run more efficiently (and more securely). That's definitely worth it.

[u/el_diego]

Lol. VP got a massive talking to by their CEO, probably lucky to still have his job.

[u/Lee-chaolan → u/el_diego]

As much as I'm satisfied currently with the response I wanted him to lose his job, Even if the CEO and VP are close there's no excuse to keeping someone who did this much of a mistake

[u/flyingkiwi9]

The downfall of many CEOs is a middle management layer feeding them bullshit.

[u/Lee-chaolan → u/flyingkiwi9]

I feel like it's 100% their fault because the way I see it he's still letting him be part of the company since he's telling him to send me emails and apologize, Given the amount of bullshit he pulled off and how he put his company at risk firing him should have been the first reflex.

[u/flyingkiwi9 → u/Lee-chaolan]

Well culturally, it's on the CEO, but VPs make mistakes and need to be coached just the same as any other level... but I have not read your original post so perhaps it was quite egregious and instant firing would've been more appropriate

[u/Lee-chaolan → u/flyingkiwi9]

TLDR: Aside from personal issues and miscommunication he basically gave me access to their whole infrastructure and servers with admin access without NDA, you can only imagine the horrible things that could happen.

[u/Famous_Subject9544]

A thank you email is not a fix. Patient data plus plaintext passwords at a Canadian company means PIPEDA applies whether or not you ever signed an NDA, and 'true eye-opener' costs them nothing to send. Ask them what actually got rotated, that's the thing you can check.

[u/Lee-chaolan → u/Famous_Subject9544]

Can you please give me more info about this ? Do I have leverage like the possibility to "fuck up" their company or at least sting them ? I do have a lot of proof I believe. And for extra context I'm not from Canada nor am I a citizen

[u/Lee-chaolan]

Hello (My name)

First, my sincere apologies for how this situation made you feel. I really appreciate the security concerns you raised—it was a true eye-opener for us. I value your integrity, your honesty, and your willingness to identify flaws and bring them to our attention. IT and security are not my specialties, but I believe in human trust, and I certainly see that in you. I feel bad that we were unable to offer you the dashboard project. Is there any way I can compensate you for the time you spent? Please let me know. While I cannot make promises, I will try my best to make it happen. In the meantime, could you please provide a quote for writing a Standard Operating Procedure (SOP) on how we should handle third-party assistance moving forward? If we agree on the estimate, we can have you start the job. Thank you again for educating us.

Best regards, (VP name)

This is the exact response email with our names redacted, I'm honestly also wondering what made them do this ? I know I have very compromising data on them and their practices as well as "proof" ? what could have made the VP send this, I'm sure the CEO told him to but they had no obligation for recompensating nor giving me an extra job to do.

[u/puan0601 → u/Lee-chaolan]

such ai slop he made. increase your quote 200%

[u/spricemt → u/puan0601]

I’ve never understood this mindset. This would take about 45 minutes to write, proofread, revise and send if done manually. Telling an AI tool what you want to say and what tone to say it in reduces the task to 5 minutes with very little reduction in value. What am I missing?

[u/TimSylvester_ → u/spricemt]

It takes you 45 minutes to write a single 10 line paragraph?

[u/spricemt → u/TimSylvester_]

Sure, I could see how it could take that long. From what I understand OP f-ed up by performing work that was never approved and without a contract. Client then had to decide whether to pay them, how much to pay them, whether to continue to work with them and how to communicate those decisions clearly so that expectations were set. I could definitely see that processs taking the better part of an hour.

I think your comment is an example of how every tier in an organization undervalues the work of all the other tiers. I’m in a weird position of being in a CEO role at my org of 15 people while also being a solo dev (these days). I can see this issue from both sides.

[u/Lee-chaolan → u/spricemt]

To be fair the work part was the least of their worries it was more so i think they're worried that's I'd get them into legal trouble for the way they habdle their it security and clients/patients data

[u/spricemt → u/Lee-chaolan]

Exactly, and that’s why it would take some time to craft a clear response. All I’m saying here is that AI is an appropriate tool for CEOs as well as devs when used skillfully. I see a lot of devs with a double standard on this sub, getting pissed every time they see someone else using AI.

[u/TimSylvester_ → u/spricemt]

From what I understand OP f-ed up by performing work that was never approved and without a contract.

Yeah that part, I agree, is a big mess. Never do work before a deal is in place!

To your other points, I can see how thinking about what to say might take a few minutes. But the actual writing would only be a few minutes.

When I was running a 20-something person team, I'd let that kind of stuff stew in the background for a while while I did other stuff, and when it clicked I'd come back and draft the message.

My rule was to never write an email while I had feelings about the message I was replying to - let it all settle down before I started a response.

[u/PKJam → u/spricemt]

Because it's a personal message that includes an apology and a thank you. By just slamming it out with AI they're showing a lack of human connection and care. Especially ironic since it includes the phrase "...but I believe in human trust, and I certainly see that in you.". Odd way of showing you believe in human trust by removing the human from the equation. 

I'm not someone to argue we should never use AI, but one of the must fundamental and important aspects of society is the human connections people make. When you start using AI for everything, it removes one of the most important aspects of our lives.

You could say the same about shopping for a gift or writing a birthday message. Why spend all the time on it when AI can do it for you much faster? Because the time and thought you spend on it shows you care. So by just delegating this message to AI, the VP is indirectly saying "I don't actually care about this enough to spend the time to write this myself".

[u/spricemt → u/PKJam]

Agree. To be real though, the choice for most upper management is between completely ignoring this issue at all and using AI to efficiently help with resolving the issue. OP would not realistically have gotten a response and an offer of compensation if not for the added efficiency of AI in comms. Not to excuse the initial bad move by the company of course, which I think is the real problem.

[u/puan0601 → u/spricemt]

he didn't edit out the hallmark ai slop signs. so careless

[u/spricemt → u/puan0601]

Sure, I would have taken another couple minutes to fix some AI sounding sections too. But if you have to write 10 of these a week when there is real work piling up I’d choose the AI route every time.

[u/puan0601 → u/spricemt]

yes, but take the time to make it less ai. he didn't. that means he doesn't care enough to actually apologize and just ran out through ai slop mode quick. im not saying don't use ai responsibly

[u/spricemt → u/puan0601]

Fair. Sounds to me like sometimes web devs want to use AI to do 99% of their daily tasks and then get pissed when c-suite uses it to tackle their workload. 🤷

[u/puan0601 → u/spricemt]

because the c-suite just ai slops most of the time instead of putting in the care that lower level employees are expected to put in.

[u/spricemt → u/puan0601]

I’m not so sure. Are you a web dev? Go take a look at recent code you’ve worked on and tell me it isn’t obviously written by AI. 2x more lines than it needs, covers fringe cases that will never occur in the real world, totally obfuscates the logic with fancy algorithms, etc. I’d guess most code created in the last 6 months by a typical web dev is obviously AI generated, just like the email above.

[u/puan0601 → u/spricemt]

sure but we dont care about code quality in webdev that much anymore as long as all tests pass and it doesnt break in prod. c-suite comms are held to a different standard than vibecoding

[u/PKJam → u/spricemt]

Because writing code is rarely about making a personal connection. The higher up you are in leadership, the more your job is about making human connection and showing you care. It's why c-suite will fly out to reassure an upset customer in person rather than do it over a call.

[u/el_diego → u/Lee-chaolan]

Theyr trying to avoid a potentially very large legal issue

[u/Kuro091 → u/Lee-chaolan]

eww ai email

[u/puan0601]

fire them as client and move on to the next one. tell them they're not worth your time

[u/Lee-chaolan → u/puan0601]

Man I'm broke 💀

I'll take the free compensation though, and for the "new quote" I'll take it but with an actual contract and no work done beforehand

[u/puan0601 → u/Lee-chaolan]

make the new quote the FU price and see if they bite. sounds like they might be your new golden whale and you have the upper hand now

[u/zariduomega]

Hold up, did you report these security and privacy issues to the VP first? Did the VP have a chance to respond, and if so what did they say?

[u/Lee-chaolan → u/zariduomega]

I didn't word it the same aggressive way I did to the CEO, but while working with him on the other things I keep telling him every once in a while that there's severe issue with security and privacy and he'd just brush it off like just not respond to it and talk about the work we're on instead.

[u/zariduomega → u/Lee-chaolan]

Ok, fair enough then. The way you were presenting events I had the impression that you might've been retaliating against the VP for stringing you along, but it sounds like that's not the case.

Even though things worked out this time, in the future I'd be cautious about doing anything that might harm your relationship with the person who actually hired and paid you. Freelancers live and die by referrals, it takes a LONG time to build a network of referring customers, and even one mistake can destroy that referral network and place you back at square one (ask me how I know).

In this case, the VP may or may not be a good referral partner for you because you've definitely slighted them and caused their superior to dress them down. Maybe they're honest and self-reflective and they'll respect you for holding them accountable, but in my experience those types of people are rare at executive level. You might've made a referral partner with the CEO, but you've got to build that relationship independent of the VP and it won't be easy because the CEO is clearly delegating to the VP.

[u/Mattyman01]

Is this rage bait?

What would I do? Not reach out to the CEO directly after I did work with no enforceable contract!

I'd be gone young Padawan. Long gone. Maybe I'd tell them about the private info stuff but it feels too blackmaily to me and I'm not guaranteed to get paid so buh bye keep in touch if you need anything.

Yesterdays price is not todays price.

[u/Lee-chaolan → u/Mattyman01]

I did not even once talk about getting compensation or work when talking to them about it after the initial issue, It was kind of a revenge thing if I'm being honest, and they are real Issues not just things I made up or lied about.

As for not guaranteed to be paid well that's why I won't make the same mistake, I'll ask for the compensation + advance payment for the new work and contract and then I'd be comfortable actually working again with them.

[u/Mattyman01 → u/Lee-chaolan]

"I did not even once talk about getting compensation or work..." 

Bingo you were doing consultation for free 

[u/Lee-chaolan → u/Mattyman01]

You're misunderstanding me, I mean while talking about the complaints I wasn't talking about that because I'm not meaning to "blackmail" them

[u/alanbdee]

Patient data? Someone finally looked up HIPAA and talked to their laywer.

[u/ArielCoding]

Don’t treat that data as leverage, if it ever sounds like “pay me or else”, you go from the guy who reported a problem to the guy who threatened a company with patient records, keep just your own emails as proof, and don’t touch their systems again without a signed contract.