5 Nov 2026For creators6 min read

Someone Copied My Code – What Can I Do?

If someone copied your code, first check what your license allows: open-source licenses permit copying on conditions (attribution, keeping the license, sharing changes under the GPL), so the problem is often a broken condition, not the copy itself. Then save evidence of their copy before it is rewritten, ask them to comply, and if they do not, send a takedown notice to the host; GitHub, GitLab and app stores all process copyright notices. Throughout, you will need to show your code existed first. Git history helps, but commit dates are set by whoever commits, so an independent date on a tagged release is much stronger.

This is general information, not legal advice for a specific dispute.

Step 1: what kind of copying is it?

Situation	Usually means	First move
Your MIT/BSD/Apache code reused with your copyright notice removed	A license condition is broken; the reuse itself was allowed	Ask them to restore the notice and license file
Your GPL/AGPL code inside a closed-source product	The copyleft condition is broken (source not shared)	Ask for compliance: release the source or stop distributing
Your private or proprietary code published or sold by someone else	Plain infringement, often a leak or a former collaborator	Collect evidence, then a takedown notice; consider a lawyer
A former employer or client using code you wrote for them	Often theirs by contract or employment law	Read your contract before doing anything
Someone built the same feature or algorithm independently	Not copying: ideas, algorithms and functionality are not protected	Nothing to enforce unless the code itself was copied

Step 2: collect evidence of the copy

Clone or download their repository now, and record the commit hash, URL and date. Forks and repos get force-pushed or deleted.
Archive the pages (repo page, package page, app listing) with the Internet Archive's "Save Page Now".
Find the fingerprints of copying: identical comments, typos, unusual variable names, dead code, your old bugs and test fixtures. These matter more than similar structure.
Check Software Heritage (archive.softwareheritage.org), which archives public repositories with crawl dates and can show what existed when.

Step 3: show your code came first

Git history shows how the code developed, but author and committer dates are set by your machine and can be rewritten, so on its own it is weak evidence of time.
Hosting records (push events, pull requests, issues, releases on GitHub or GitLab) are better, but they are controlled by a platform you do not own and can disappear with an account.
Package registries (npm, PyPI, crates.io) show publish dates for released versions only.
A qualified timestamp on a ZIP of a tagged commit, or on a file listing commit and tree IDs, is an independent date presumed accurate in the EU.

Step 4: ask, then take it down

Open an issue or write to the maintainer. Many license violations are carelessness and are fixed within days.
GitHub: send a DMCA takedown notice through its copyright form. GitHub publishes notices in its public DMCA repository and may disable the repo and its forks.
GitLab, Bitbucket, npm, PyPI, app stores: each has a copyright complaint form. In the EU, hosts must also act on notices of illegal content under the Digital Services Act.
For commercial products or a former partner, talk to a lawyer before going public.

What a StampR certificate adds

A StampR certificate binds the SHA-256 fingerprint of your release archive or commit manifest to a qualified electronic timestamp from BORICA B-Trust, together with your declaration that you are its author. Under Article 41(2) of the EU eIDAS Regulation, its date and integrity are presumed accurate in every EU member state. Your source never leaves your machine: only the fingerprint is sent, so private code stays private. If a copy appears later, you or your lawyer can show on the verification page that your archive matches the certificate and when it was timestamped. The best habit is to timestamp each tagged release, which takes a minute.

Timestamp your next release – the first certificate on an account is €4.90.

What it does not do

It does not decide who owns code written in employment or under contract. Your contract and the law do.
It does not cover ideas, algorithms or functionality. Copyright protects the code as written.
It does not take anything down. Hosts do, after a notice.
It does not create or record any rights. Copyright in code arises when you write it.
It cannot backdate. Timestamp before the copy appears.

The wider context: copyright protection – how the right arises, and where it is weak in practice.

Frequently asked questions

Is it illegal to copy code from GitHub?

How do I file a DMCA takedown on GitHub?

Use GitHub's copyright claims form, identify your original work and the infringing repository, and include the required statements. GitHub reviews it, publishes the notice and may disable the repository.

Can someone copy my app idea?

Yes. Ideas, features and algorithms are not protected by copyright; only the code, text and graphics as written are. Patents and trade secrets are separate routes.

Do Git commit dates prove when I wrote the code?

Not on their own. Commit dates are set by the committer's machine and can be rewritten. They show how the code developed; an independent timestamp anchors the date.

Is my source code uploaded to StampR?

No. The fingerprint is calculated in your browser and only the fingerprint is sent, unless you choose to store a copy.

Sources

Directive 2009/24/EC, Article 1 – computer programs protected as literary works; ideas and principles excluded.
GitHub DMCA Takedown Policy – how notices are handled.
Software Heritage – public archive of source code.
Regulation (EU) No 910/2014 (eIDAS), Article 41 – legal effect of qualified electronic timestamps.

Sources checked 2026-11-05.

Certify your work with a trusted date.

Create a certificate →

Your first certificate is €4.90 with an account.

← Back to the blog