This addendum adds source-code-specific handling rules for a person receiving access to the company's repositories and development infrastructure. It supplements the confidentiality agreement already in place between the parties and does not replace it.

1. Parties

This addendum is between Company name (the "Company") and Engineer full name (the "Engineer"), engaged as Engagement role or title. It takes effect on Effective date and forms part of the confidentiality agreement between the parties.

2. Covered materials

"Code materials" means the Company's source code, repositories, build and deployment configurations, infrastructure definitions, API keys and secrets, internal libraries, technical documentation, and data accessible through development or production systems — including materials belonging to the Company's clients.

3. Repository and copy rules

1. The Engineer will access code materials only through the Company's approved accounts, repositories, and tools.
2. No personal copies: the Engineer will not clone, mirror, fork, download, or copy code materials to personal accounts, personal devices, personal cloud storage, or personal repositories, and will not email or message code materials to personal addresses.
3. The Engineer will not publish code materials, in whole or in part, in public repositories, forums, paste sites, portfolios, or interview exercises, and will not use them in side projects.
4. Snippets shared for legitimate work — for example in code review or support tickets — stay within the Company's approved systems.

4. Credential hygiene

1. Credentials, tokens, and keys are personal to the Engineer and must never be shared, reused across services, or committed to repositories — including private ones.
2. The Engineer will use the Company's required authentication protections on every account with access to code materials, including multi-factor authentication where offered.
3. The Engineer will store secrets only in the Company's approved secret-management tools, and will report any suspected credential exposure immediately so it can be rotated.
4. The Engineer will not attempt to access repositories, environments, or data beyond what their role requires.

5. Devices and tooling

1. The Engineer will work on code materials only from devices that meet the Company's security requirements — including screen lock, disk encryption where available, and current security updates.
2. Third-party tools, extensions, and services that process code materials — including AI-assisted development tools — require the Company's prior written approval. Approved tools are listed here: Approved tools list.
3. The Engineer will not disable or bypass the Company's security controls, logging, or access management.

6. Incident reporting

The Engineer will report any suspected leak, unauthorized access, lost device, or accidental exposure of code materials to Security contact as soon as they become aware of it, and will cooperate with containment and investigation.

7. Off-boarding

1. When the engagement ends, or earlier on request, the Engineer will stop all access to code materials, delete any local working copies and build artifacts, and remove stored credentials from devices and password managers.
2. The Engineer will confirm completion of these steps in writing.
3. The obligations in this addendum continue after the engagement ends for as long as the underlying confidentiality agreement provides, and for trade secrets as long as the law protects them.

8. General

1. If this addendum conflicts with the confidentiality agreement, the stricter handling rule applies to code materials.
2. Breach of this addendum is treated as a breach of the confidentiality agreement, with the same remedies — including injunctive or other equitable relief.
3. Amendments must be in writing and signed by both parties; an unenforceable provision does not affect the rest.

Signatures

Engineer: ✍ Engineer signature Date: Engineer signature date

For the Company: ✍ Company signature Date: Company signature date