Sounds like she went through standard procedure to add code, but the feature was not sanctioned by management....

i.e. if you work on a payment system, add you add code to siphon sub-cent rounding "errors" to a "settlement" account, said code may pass review (because it looks legit to code reviewers), but I bet management would be pissed at the change if not prior approved.

So do nothing until management orders it, is that how they want it now? This is what they'll get!

Not cool to equate a notification of rights, to a crime (theft).