If your product's core IP lives in a contractor's head and a GitHub repo they own, you do not have a company. You have a hope. Fix the paper this week.