Comment by arty_prof

Best thing you can do is sandbox them, always check what they want to change with config file (package.json).

Restrict any db operations, for example restrict to run migrations with prisma orm.

Also restrict access to .env or your project configuration with credentials even for dev environment.