How to protect source code when a developer leaves

An engineer who spent three years on your product understands the architecture, knows which approaches failed, and remembers the shape of the solution. All of that leaves with them, and none of it can or should be stopped.

Any vendor claiming otherwise is selling something that does not exist, and the pitch is worth being suspicious of. Non-competes are narrowing in most jurisdictions, and memory has never been enforceable.

So the question is not how to stop someone taking what they learned. It is whether they also take a readable copy of the thing itself.

Understanding conceptually how your matching algorithm works is worth something to a competitor. Rebuilding it from that understanding still takes their team months, and what they produce is their own.

Having the source is a different order of problem. It compresses months into an afternoon, it carries every edge case you discovered the hard way, and it is the version that turns up in litigation.

The first is the ordinary cost of employing people in a competitive market. The second is avoidable.

The realisation that makes this workable: on a team of thirty, perhaps three people ever need the differentiating modules in readable form.

Everyone else calls them. They build features that use the scoring model without reading it, run the full application locally, debug their own code against it, and ship. The protected parts behave exactly as expected, which is the entire requirement.

That is less a restriction imposed on developers than a description of how large codebases already work. Most engineers do not read most of the repository.

So when someone leaves, planned or not, they take what they learned, which is theirs, and their references, which they earned.

What does not go with them is a working copy of the modules you would be afraid to see elsewhere, because it was never on their machine. There is no last-day clone to worry about, no forensic exercise on a returned laptop, and no awkward conversation with someone you liked working with.

This protects what you protected. Modules left readable are readable, and a developer with legitimate access to the sensitive parts has legitimate access to them.

It reduces how many people hold the crown jewels from everyone who has ever had a checkout to the handful who genuinely need it. That is a large reduction, and it is not the same as a guarantee.