LAMP stack, dedicated server.
I set up some MySQL users, gave them full access rights to the necessary databases, and provided the user credentials to some freelance developers.
Now that the project is concluding, I've:
- changed those passwords and updated any reference to them in the code
- removed all developer FTP accounts
- changed the cPanel password
- verified that remote MySQL access is disabled
My question is:
What security risks are created and/or exacerbated by a malicious actor having valid MySQL credentials but no FTP, SSH, cPanel, or remote MySQL access?