A contractor has requested access to my ‘source code’ or repo

If this happens Shipwreck Studio will need your express written permission to give it to them, only after you understand any potential exposure risks. Please read everything below before consenting

Review of what this means:

1. Upsides:
   1. They now have every potential tool they need to complete work you may have hired them to do, however, in 95% of cases they do not need this extreme level of access to do the work and we often find it odd if they ask for it
   2. They can run a local dev server at home to work on your project if there is not an online dev server available

2. Potential down sides (None of this might happen but you need to understand all of it):
   1. As soon as they download that source you have lost control of it forever
   2. They now have the ability to reproduce / repackage / rebrand / resell / replicate your entire application as many times as they like for whomever they like, very easily and quickly
   3. They now have access to all and any proprietary data in your database / potential corporate secrets, user lists etc..
   4. With open access to your source they can use software tools to scan it for the types vulnerabilities that CAN NOT be detected without access to that source code
   5. With access to your repo they can insert malware or backdoors completely undetected
   6. We can no longer guarantee the safety of your hosting accounts/servers/applications/sites if a third party has this kind of access
   7. If they are doing your work on a “local dev server” of their own, you have no control over that, no way of seeing what they are working on as local devs are not online, no way to know

3. Solutions we recommend:
   1. Have a second server fired up as a dev server online, that you control. This negates 100% of any contractors needs to build a “local dev” with your source code
      1. Am I still exposed with an online dev server of my own?
      2. Yes you are – but to a much lower degree, the risks are different and more controllable
   2. Safest way to bring code changes over from the live dev to the main site
      1. Have your contractor organise ALL of their code additions into their own plugin or module, completely separate from your existing codebase. Having them weave random threads of Javascript/css/html/php etc through your existing code is a massive problem and can cause no end of drama down the road for your application. Isolating the new code like this allows it to be effectively scanned and examined for a lower risk of problems or compatibility issues etc.
         1. The more complex your application becomes the more often new code will conflict with something old code does, causing things to break. This is a daily occurrence for applications in constant dev. Often these problems go unnoticed until a QA officer/site owner/site customer finds them down the track. Be aware of this and aware of the dozens or hundreds of hours work it can take to resolve next week/month/year in many cases. These problems are amplified many times when running different devs on the same project, or changing devs on the same project
         2. Organising an outside contractors code completely into one plugin greatly aids in helping to find such conflicts quickly. Quick test such as disabling one plugin or another to isolate which codebase is the offender really do aid in bug hunting
   3. Discuss with us the specific nature of the contractors tasks and we will tell you how much access they need in order to complete them
      1. LOWEST RISK – In most cases contractors only need backend access to your CMS
      2. MEDIUM RISK – Beyond that some may need access via FTP to your server
      3. HIGHER RISK – Beyond that some will ask for access to your cPanel
      4. VERY HIGH RISK – Beyond that some may ask for Console or even ROOT to your server but that is simply not allowed in our hosting environments
      5. VERY HIGH RISK – Beyond that some may ask for access to your SOURCE CODE or REPO
      6. DON’T hand out your source or the ‘keys to your kingdom’ unless you absolutely need to

4. If you have any questions please speak to your client manager and be sure you fully understand all of the above

5. If you do accept the risks (For instance the contractor is a trusted developer that you have met in person with, have an NDA signed, and you feel you can trust with the keys to your kingdom) Then please email us now and tell us in writing you have read this document “A contractor has requested access to my ‘source code’ or repo” and are happy to hand over your source
   1. In doing so you release Shipwreck Studio from all responsibility and duty of care to protecting your code/ip/security as it is now out of our hands