Why not just share your password?
- Your login usually opens everything: billing, deleting the project, other projects.
- Two-factor codes go to your phone, so you end up as a bottleneck.
- You can’t tell their changes from yours, and you can’t remove them without changing your own password everywhere.
Tool by tool
GitHub (your code)
Repository → Settings → Collaborators → Add people, using their GitHub username. On a personal account every collaborator can push changes. For read-only access, move the repository into a free GitHub organization and give them the “Read” role.
Lovable, Bolt and similar builders
If your builder syncs to GitHub, share the GitHub repository rather than your builder account. If it has workspace invites, invite them to that one project only.
Supabase (your database)
Organization → Team → Invite, with the lowest role that lets them do the job. Use a read-only role for a review if your plan offers one.
Your host (Vercel, Netlify, Cloudflare…)
Invite them as a member of the team or project. Most hosts have roles that can deploy but not change billing.
Keys and secrets
Don’t paste secret keys into chat or email. If an engineer needs a key, they can usually read it from the host or database dashboard you’ve invited them to. If you must pass one on, use your password manager’s sharing feature, and rotate the key when the work ends.
When the work is done
- Remove them from GitHub, your builder, Supabase and your host.
- Rotate any key they saw.
- Keep the written summary of what was changed, for next time.