TL;DR
The day a freelancer finishes, revoke every access they had and rotate anything they could have read. Then audit the code they wrote, and confirm the whole thing is actually in your repository. 5 items are same-day, 9 more belong in the first 48 hours, and 4 are worth doing once the urgent ones are clear.
The freelancer did good work, the project is done, everyone is happy. Then the part nobody schedules: making sure they can't still get in. Contractor-related incidents tend to land after the engagement ends, when nobody is watching that account any more and the invoice is already paid. Run this list before you call the handoff complete.
Quick Checklist (5 Critical Items)
Immediate Access Revocation 5
Credential Rotation 4
Code Audit 5
Documentation and Handoff 4
Prevention Is Better Than Cure
All of this gets easier if you never hand over much in the first place. Scope the credentials narrowly, point them at staging, and treat admin access as something you grant for a specific reason rather than by default at kickoff.
Time-limited tokens and a separate service account per contractor are worth the setup. Revocation becomes one action instead of a scavenger hunt across eight dashboards, and if something does go wrong, the damage stops at whatever that one account could reach.
Should I give freelancers access to production credentials?
Don't, if you can avoid it. A staging environment or a limited-scope credential covers most of what a contractor actually needs. When production access really is unavoidable, rotate those credentials the day the engagement ends rather than adding it to a list you'll get to later.
How do I verify a freelancer did not leave a backdoor?
Read the diff. All of it, with extra attention on anything touching login or permission checks, since that's where a backdoor hides in plain sight as a plausible-looking condition. Then grep for hardcoded credentials and admin routes that skip your auth middleware. For a project handling money or other people's data, a paid code review is cheap next to the alternative.
What if the freelancer refuses to hand over code or credentials?
This is what the contract was for. It should have said who owns the code and what handoff means before anyone wrote a line. If they refuse anyway, stop negotiating and start rotating: revoke every access, change every credential they could have touched, and talk to a lawyer. The contract dispute and the security work are separate problems, and only one of them is urgent.
Scan the Handed-Off Code
Reading someone else's code is slow, and it's easy to miss what isn't there. A scan checks the deployed result for exposed keys, open endpoints, and missing headers.