By Pallav Boonlia
Founder & CTO, NakodaX ·
NakodaX blog/Source Protection·3 min read
How do you protect source code when a contractor leaves?
Turning off a contractor's repository access does not remove the copy already on their laptop. With NakodaX Source Protection, the key files are encrypted and run only with a license. Revoke the license when the contract ends and those files stop working at the next key request.
Outsourcing was never the risk. Losing control when the work is done is the risk.
On this page
Every company that outsources development reaches the same moment. The contract ends, the invoices are paid, and the developer moves on.
Your code is still on their laptop.
Nobody stole anything. You gave it to them because they needed it to work. The problem was never a break in. It was that normal work leaves a full copy of your product somewhere you no longer control.
What happens when the contract ends?
A company hires an outside team to build a pricing engine. The team clones the repository and spends six months building. The work is good.
At the end, the company turns off their access and considers it closed. It is not. The clone and the build files are still on their machine. Turning off access closes the front door and does nothing about the copy that already left.
Why do contracts and trust not fix this?
A signed agreement helps after something goes wrong, but it does not prevent it. Trust is a relationship, not a safeguard. Code that is hard to read slows someone down, but not a person who has the whole thing and the time to study it.
What does NakodaX change?
Source Protection starts from the assumption that they already have the code. It encrypts the few files that carry your real value. The contractor builds, tests and ships as before.
Developers get a developer license. It opens stand ins, which are placeholder versions of the protected files with the same interface, never the real code. If a developer must change the real protected code, a different person on your team approves a time limited change session first.
When the contract ends, you revoke the license. The protected files stop working, not because anyone went looking for them, but because the code asks NakodaX for a key before it runs, and the answer is now no.
Do you have to protect everything?
No. Most of a codebase is ordinary work anyone could rebuild. Protect the handful of files that carry the advantage: the scoring logic, the algorithm, the integration that took two years. Leave the rest open.
What does this not do?
While software runs on a licensed machine, the protected code is readable in its memory. Revoking takes effect at the next key request, and a running process can keep going until its cache refreshes, which can take hours. It cannot recover logic someone has already copied or learned.
The takeaway
If you cannot say what happens to your code when a contract ends, you do not have an answer yet. This is one.
Related product
NakodaX Source Protection
Let vendors and customers build or run software without receiving selected proprietary source code in readable form.
See how it worksCommon questions
Does removing a contractor from GitHub remove their code?
No. The clone already on their laptop stays. Source Protection makes the key files in it stop working once you revoke their license.
Can developers still work if the key files are protected?
Yes. They build against stand ins that have the same interface. Changes to the real code go through an approved change session.
How fast does revoking work?
At the next key request. A process already running can continue until its cache refreshes, which can take hours.
