Is it a red flag if a web developer keeps asking for full admin access?
Asked by
CuriousCoder42
I recently noticed that my web developer has been asking for complete admin credentials every time they need access to something like our hosting service or Google accounts. This makes me uncomfortable and seems like a major red flag. For instance, they were given limited FTP access to a subdomain but claimed they couldn't proceed because they built a page using ReactJS, stating it "can't be deployed over FTP as they deploy directly from GitHub." I'd love to hear everyone's thoughts on whether this is standard practice or if I should be concerned about their request for admin access. Thanks!
Answers
I get the concern! FTP access alone feels outdated—real developers don't ask for that anymore unless absolutely necessary. You should definitely clarify with your developer what their deployment process involves. If they're just starting out, they might not be familiar with best practices, but that doesn't excuse asking for unnecessary access.
Reply to this answer
It's tough to say; I wouldn't automatically label it a red flag. Sometimes, requests for more access stem from a desire to minimize friction during development. But still, any request for admin credentials needs a solid justification. Just make sure you're aligned on the deployment method and what's actually needed.
Reply to this answer
Honestly, it sounds more like your developer might not be set up for the task at hand. It's a bit strange they're asking for admin access just to do some front-end work. If they're trying to deploy on your server without proper CI/CD in place, that could indicate a lack of experience or knowledge. I’d recommend having a chat with them about what exactly they need and maybe involve your IT team to handle the permissions instead.
Reply to this answer
It really depends. In some cases, especially for smaller projects where the company lacks tech support, providing admin credentials might be the only way to avoid endless back-and-forth. But yeah, generally, the best practice is to stick with the principle of least privilege. As for the FTP thing, that raises a flag too—React projects can be deployed via FTP; it just requires building the project and uploading the files, not an admin role.
Reply to this answer
It’s definitely questionable, especially with the way they're going about explaining it. They could be trying to simplify their workflow, but true pros usually find workarounds that don't compromise security. If they can't explain why they need that level of access, I'd be cautious!
Reply to this answer
Add your answer
Answers are reviewed before publication.
Related Discussions