Is it safe to give a coder an admin log in?

[bigbob2]

I need to outsource some set-up work on my 2.3.3 site and I would like to give an admin log in to the coder. They are someone that I do not know, but are sourced through vworker.com

 

I will take backups of my database and files before this work is done, but if I don't give them my config files etc. am I right in saying that they only malicious thing that they could do would be to mess with products etc.?

My site is not live yet (hidden directory), so there is no payment detail or customer detail in the site yet.

 

Your thoughts?

 

Kevin

[Jack_mcs]

I can't imagine what kind of work they can do from just the admin but If the person is dishonest and wants to use this as an opportunity to steal your data or to cause some sort of problem, then, yes, they could still do it with just admin access. Giving out logins is a necessary evil when you have a shop. The only way to be sure they can't cause problems is to create a copy of your shop with its own database and then delete that when they are done (you have to copy their work, of course). I am not familiar with that site but one would generally be better off hiring someone from here where you know they have some experience with oscommerce. There is a forum here where you can ask for quotes. Of course, even if you chose someone from here, it doesn't mean they are honest.

[burt]

Why not get a coder that is a known name from this forum. It is why the commercial support area was set up.

 

You should not give anyone your login credentials unless you trust them fully.

 

By getting someone from an external site you have no way to check their credentials beforehand.

By getting someone from this forum, you can look back through their posts, you can trash their reputation if you want (as has happened in the past couple of months) and you continue to support the osCommerce eco-sphere.

[Guest]

@@bigbob2

 

 

If you are hiring a developer, send them the site in .zip format along with the database SQL file and they can set it up on their development server to work on it. You can then approve the work on their development server before having it put live on your server. You could even go as far as to have the developer .zip it back up and send it to your so you can install it yourself. This way, there is no exchange of passwords.

 

 

 

Chris