What file or data I should NOT give outsourcing developer for security when they need a copy site of my site?

Question

I'm asking a outsourcing developer to modify some part of my site and then he needs the copy of my site as a test site.
My site is already working site and has users registered. What comes in mind first is deleting user table from database to protect the personal information.

And the what else I should NOT give the developer? I trust the one who works on my site of course. But in generally is there any files or database table that can be harmful if　the third party obtains?

Answer 1

There are two places I would look:

1. Any credentials stored in places like the settings.php file which has database credentials and potentially other sensitive information. If it's not in settings.php (e.g. some sites use settings.local.php that is included into settings.php) then just be aware of that and who has access to it. There may be other credentials stored in other .php files.
2. Your database has a lot of potentially sensitive information in it. See this article about sanitizing the Drupal database backup for advice on what you may want to remove.

Also, if you trust them to write module or tpl files then you should trust them with your data. After all: they could make a mistake or add a back-door to the site to steal this information if they want it. I see both of the above suggestions as "best practices" regardless of who is doing the work. Everyone should remove credentials and sensitive database information prior to giving out copies of the information.

Answer 2

Deleting the user table might break features that rely on node authors or some other user information. Try setting every user's email to [email protected] and their password to 'password'. You shouldn't give the settings.php file, since it has your database credentials and the cryptographic salt Drupal uses to hash users' passwords.