First of all, IANAL (probably a good thing). Maybe I'm just paranoid, but I would only say to not burn any bridges. The consulting work would obviously involve seeing the @mail source code. If an NDA were involved then his options would be limited after doing the work, and I don't know if even not signing an NDA is enough. He would see their copyrighted code and could later be accused of including their work when starting to work on roundcube again. AFAIK a simple letter to whoever hosts roundcube's site/server would be enough to kill it off with that kind of accusation (legal notices to ISPs tend to get sites killed off immediately, no questions asked even if the site is legit). If the consulting work could be pulled off without giving up the rights to roundcube (simply do the work just like any other contractor) and somehow come up with a legal agreement to not sue for (accidental?) reusage of @mail code in roundcube, I say it sounds like a good deal to make some money and travel. Anyways, I am amazed at how good roundcube is at such an early stage and can't wait for the next beta release.