The GitHub Commit That Exposed Corporate Espionage

Background

A technology company discovered fragments of their proprietary machine learning algorithm in an open-source repository on GitHub. The code was not licensed for public use and contained trade secrets.

Investigation Methodology

1. Code Similarity Analysis: We performed syntactic and semantic code comparison between the proprietary codebase and the public repository, identifying unique variable names, comment patterns, and algorithmic approaches.
2. Contributor Analysis: The GitHub repository's contributor history was analyzed, including commit timestamps, email addresses associated with commits, and contribution patterns.
3. Employee Digital Footprint Mapping: All employees with code access had their public GitHub profiles cross-referenced against the repository.

Key Findings

• The repository contained 73% code similarity with the proprietary algorithm, including unique variable naming conventions only used internally.
• Commit history showed code was pushed from an email address that was a slight variation of an employee's corporate email.
• The commit timestamps aligned with the employee's after-hours badge access records at the company's office.

Outcome

The evidence was provided to the company's legal team. The employee was confronted and admitted to the leak. The repository was taken down via DMCA. Total investigation time: 1 week.