How I protected my free trial code from being stolen with a custom license trap

I got roped into a multi stage interview process for a senior cloud infrastructure role at a logistics startup. After passing three separate technical calls where I basically architected their data pipeline for free during the system design rounds, the engineering manager dropped the hammer. He told me they had a final take home assignment . They wanted me to build a fully functional microservice that parses their real time fleet telemetry data and pushes it to an S3 bucket with specific partitioning logic.

They gave me a mock data schema but the infrastructure spec was suspiciously detailed. It felt exactly like a real feature they needed for their current sprint backlog. I knew if I just handed over a clean github repository link they would ghost me, patch my code into their main infrastructure, and use it without ever sending an offer. But instead of flat out refusing and wasting the time I already invested, I decided to set a compliance trap.

I built the microservice inside a clean public repo, but before I sent them the link I did two things. First, I added a highly restrictive, non-standard custom license file directly to the root directory. I used a modified version of the Commons Clause attached to an MIT framework, which explicitly stated that the source code was strictly for evaluation purposes during an active recruitment cycle and absolutely prohibited any commercial application, staging deployment, or production use by the reviewing entity .

Second, I added an internal logging function that pinged a private webhook on my personal server every time the container initialized. It tracked the environment variables and the host IP without breaking anything or modifying their telemetry payload. I wrapped the built image, pushed it to docker hub, and sent the github link to the recruiter along with a polite note stating that the code was ready for their review under the attached evaluation terms .

The feedback went completely dark for three days. Then on Thursday night my webhook script started firing alerts. I checked the logs and saw my microservice wasn't being run on a local machine by an engineer checking my logic. It was actively being spun up on an AWS cluster using their corporate staging credentials. They were literally testing it against their real data streams without telling me.

I immediately sent an email directly to the engineering manager and CC'd their legal alias. I told them that my monitoring tools indicated an active license violation of the repository terms and that any further execution of the software on their AWS cluster would trigger an automatic commercial invoice based on my standard consulting rate. The container was killed exactly twelve minutes later. The recruiter emailed me yesterday saying they decided to go with an internal promotion instead. They are absolute parasites but watching them scramble to tear down that cluster was worth every line of code.