Sometimes, partially. Not usually, completely.
That gap matters more than it sounds. When a CNC program leaves your shop, whether through a subcontractor, a former employee, or a careless email attachment, it can carry more than geometry. It can carry your feeds and speeds, your fixturing strategy, and your process know-how — the stuff that actually makes your shop competitive.
This article breaks down three separate questions that often get blurred together: what's technically recoverable from a G-code file, what legal protections apply to that information, and what practical controls actually reduce your exposure.
Key Takeaways
- G-code describes machine motion and process steps, not design intent, tolerances, or parametric history
- Reconstructed geometry can still create legal exposure if the source file was confidential or contract-restricted
- Limit access by role, machine need, and customer agreement instead of blanket file-sharing
- Contracts, training, and documented workflows matter as much as technical locks
What G-code Can—and Cannot—Tell You
The CAD-CAM-G-code Pipeline
CAD defines the design. CAM converts that design into toolpaths based on chosen tooling and strategy. A post-processor then translates those toolpaths into controller-specific instructions: the G-code that actually runs on the machine.
Each step adds interpretation and strips away context. As NIST's review of integrated CAM/CNC control systems notes, different post-processors and controller dialects produce different G-code outputs even for functionally similar operations. The posted file is not a portable copy of the CAD model. It is a machine-specific instruction set.
What a Technically Capable Person Can Infer
Someone reading a dense, well-documented G-code file can reasonably infer:
- Linear and circular tool movements, which trace approximate surface geometry
- Coordinate ranges and work offsets, hinting at stock size and setup
- Drilling cycles, tool changes, and feed/speed values
- Probing routines and repeated operations that suggest inspection or quality steps
Machine Link™, Controlink's CNC editing software, displays exactly this kind of data in plain view: G00 and G01 movement commands, tool positions, and program comments like "STOP POSITION ABOVE TT PLATE" or "DRILL TO DEPTH."
That visibility helps programmers review their own work. It also shows how much a file communicates to anyone who opens it, authorized or not.
What Stays Hidden
A 2010 technical paper on NC-based reverse engineering demonstrated that toolpath data can be converted into 3D sketches, surfaces, or solids using tool diameter, milling strategy, and phase information.
The same research identified clear limits: spline approximation introduces dimensional error, and hidden or unmachined features simply don't appear in the toolpath record at all.
Commonly missing from any G-code-based reconstruction:
- Exact nominal dimensions and tolerance schemes
- Material specifications and surface finish requirements
- Design history, parametric relationships, and assembly context
- Features that were never cut on that particular setup
The same nominal part can also produce very different G-code files depending on tool diameter, cutter compensation, workholding, and CAM strategy. Two shops machining an identical print might generate programs that look nothing alike.
That variability is why a reconstructed model still needs verification against the physical part, inspection data, and drawings before anyone treats it as production-ready.
The IP Case for Controlling Program Access
Being technically able to infer geometry from a program is a different question from having legal permission to copy, modify, manufacture, or sell based on that inference. Neither answer is automatic. It depends on the facts.
More Than Shape: What's Really in a G-code File
A G-code file often contains far more than shape data:
- Proprietary feed and speed combinations refined over years of production
- Operation sequencing and probing logic
- Tooling strategy and fixture references
- Inspection routines tied to specific quality requirements
The Defend Trade Secrets Act's definition of a trade secret expressly covers technical and engineering information, including processes, techniques, and procedures. That coverage applies when the owner takes reasonable steps to keep it secret and the information has value from not being generally known. A well-optimized CNC program can meet that bar, depending on how it was protected.
Courts have also drawn a consistent line: independent reverse engineering of something lawfully obtained is not automatically misappropriation. But information entrusted under a confidentiality duty, or acquired through breach of that duty, is a different matter. Whether a program was shared under an NDA, a customer purchase order, or an informal favor changes everything about what happens next.
A Quick Decision Framework
Before sharing, storing, or acting on a G-code file, ask:
- Is the file yours? Who created it, and under what agreement?
- Was access authorized? Did the person or company have permission to have it?
- Is the information confidential? Was it marked, restricted, or understood as sensitive?
- Does an agreement restrict use? Check customer contracts, supplier terms, and NDAs.
- Could the program reveal a protected method? Feeds, sequencing, or probing logic may be more valuable than the shape itself.
Labeling a file "confidential" communicates intent, but it doesn't replace actual security measures. Reasonable protection—access controls, written agreements, and consistent enforcement—is part of what makes a trade secret claim hold up in the first place, according to USPTO's trade secret guidance.
Copyright and patent law add further layers. Copyright can protect original code expression but not the underlying manufacturing method. Patent exposure depends entirely on specific claims. None of this replaces a conversation with qualified IP counsel when a real dispute is on the table.
How to Reduce G-code and CNC Program Exposure
Least-Privilege Access and Program Lifecycle
Not everyone who touches a machine needs full access to every file. Give operators, programmers, maintenance staff, and outside contractors only what their role requires. Nothing more.
A controlled program lifecycle should cover:
- Engineering approval before release to the floor
- Clear revision identifiers so no one runs an outdated file by mistake
- Retirement of superseded programs
- Documented change authorization and rollback steps
This mirrors NIST SP 800-171's guidance on enforcing least privilege and periodically reviewing who holds what access — a control that applies just as well to shop-floor CNC networks as it does to office IT systems.
Technical Safeguards
Beyond written policy, technical controls matter:
- Authenticated, role-based access to program repositories
- Secure network segmentation between shop-floor and office systems
- Controlled removable-media use, with no untracked USB drives
- Audit logs covering file creation, edits, downloads, and transfers
Distributing production files through a managed workflow, rather than email attachments or shared folders, closes many of these gaps at once.
Controlink's Machine Link™ QUICK Serve was built around this idea. It continuously monitors CNC machines for file requests and serves the current engineering-approved version directly to the control. Operators stop relying on whatever file happens to sit on a USB stick.
That mismatch is familiar on busy floors. Scott Cooper at Snavely's Machine, running 30-plus machines across 10 control types, said getting the right program to the right machine had become an ordeal before this kind of workflow.
Strip unnecessary information from files before they hit the floor: obsolete operations, sensitive customer identifiers, and excess process comments. Keep anything required for safety or traceability intact.
A Practical Response Plan for Manufacturers
Reducing exposure starts with knowing where your files actually live.
- Inventory everything — CAD files, CAM projects, posted programs, machine backups, and customer specs, along with where each is stored and who can reach it.
- Classify by sensitivity — document ownership, access duration, and whether subcontractors need a restricted version of any file.
- Pair contracts with controls — confidentiality terms, approved-use language, return-or-delete requirements, and onboarding/offboarding checklists should back up your technical safeguards, not replace them.
- Build an incident process — if unauthorized copying is suspected, preserve logs and file versions first, restrict access without deleting anything, then notify legal and business contacts before investigating further.
- Know when to call in help — loop in an IP attorney, the customer's contract owner, or a manufacturing-IT specialist before programs go external or before you dig into a suspected leak.
None of this requires perfection on day one. It requires knowing where the gaps are and closing them in order of risk.
Frequently Asked Questions
What is the best CAD software for reverse engineering?
It depends on your starting point. Scan data needs point-cloud processing; G-code-based reconstruction needs surfacing and solid-modeling tools with strong CAM compatibility.
Can G-code be converted directly into a CAD model?
Not reliably as a complete, editable design. G-code can serve as a reference for reconstructing approximate geometry, but the result still needs interpretation and verification against the real part.
What information can someone learn from a CNC program?
Tool movements, approximate feature locations, machining sequence, tooling choices, offsets, feeds, speeds, and probing strategy are all potentially visible. Full design intent and tolerances usually aren't.
Is reverse engineering a part from G-code legal?
Authorization, ownership, confidentiality duties, and contracts control the answer. Trade secret, copyright, and patent rules apply differently by fact pattern, so treat this as a question for qualified IP counsel.
How can a manufacturer prevent unauthorized access to G-code?
Use role-based permissions, controlled program distribution, revision management, audit logs, removable-media restrictions, and contractual safeguards, backed by regular access reviews and staff training.
