My policy for this is that we have a pairing exercise that either: (a) is on sample code that the candidate brought, (b) an open source project with the end-goal being a pull request, or (c) a Make Work exercise. I do not want to have a candidate working on our real code precisely because I do not want to have the charge of unpaid work levelled against us.