privacy employment legal-terms workplace security
can i write in my portfolio about a critical security bug in my last job?
<p>I want to write about how i found a critical security bug when i was working at a company. Am going to stop working there in about a month and was just updating my portfolio with the things i did there over past three years.</p>
<p>The thing is for me this was a very big achievement and i want to brag about it, but my boss told me i have to take it down immediately or i will get in trouble. It was no details about any system or programing language and just a paragraph about it on my portfolio page.</p>
<p>What part of my contract or any contract can give employer right to do so?
This just dont sound right that i cant tell other employer how good i am</p>

<blockquote>
<p>The employee must, during and <strong>after employment</strong>, without limitation in time, observe a duty of confidentiality regarding [...]
the Company's internal affairs such as business plans, profitability, pricing, employees, methods, processes, routines, <strong>code</strong> and the like as well as <strong>other information that the Company typically wants to keep secret</strong></p>
</blockquote>
<p>The pure information that the company <em>had</em> at some time a security problem with their product is internal knowledge you only gained through working there. By what is written here, you are indeed prohibited from speaking about it.</p>
<p>If it were public knowledge, you could point to a press release and say &quot;I did that, that was me fixing the problem&quot;. That would work. Because it doesn't share anything that isn't public anyway. But you cannot share things the company wants to keep secret.</p>
<p>Finding out whether that contract is legally enforcable in your country and juristiction is the job of a real lawyer, but just as written, they are right. You signed a contract to not do that, not talk about it an certainly not publish it on the internet. So you should not do that, unless a good lawyer you trust tells you otherwise.</p>
<hr />
<p>That said, &quot;I found a security flaw&quot; is about as impressive as &quot;I found a dollar on the floor&quot;. Maybe you can talk about your knowledge to <em>prevent</em> something like it happening. That says nothing about whether or not it happened in your old company, and for me as an employer it is much more valuable to have you on board with structured knowledge you can apply, than with your memories of being lucky once.</p>
