Is it safe to add a user with a "technical" role in iTunes Connect for using test flight to send them a beta build?

Question

I am trying to recruit some beta testers for an app of mine using Test Flight. None of the testers will be in house employees or anything like that- just some folks I know who would like to help test my app (I'm a hobbyist and don't have any employees anyways).

When I went to add somme users in ITC for test flight it made me assign them a role. The only role that made sense to me was "Technical". However, I am worried that assigning somebody I don't know well the technical role will allow them to make changes to my app descriptions, reject or submit binaries, and things like that.

Is that something I need to worry about? Is there a way to assign a user the role of JUST tester without giving them access to my apps via ITC?

Apple's documentation does not seem to explicitly state what users with various roles can do.

Answer 1

No, this isn't really safe, and it's not a good idea to give the 'Technical' role in iTunesConnect to someone you don't fully trust.

The iOS 8 TestFlight system has a way to setup external testers, see the "External testers" section on https://developer.apple.com/app-store/Testflight/

The downside is that your app has to go through the review team each time you make any major changes before it goes to external testers (hence if the tester is really a close part of your team it is still advantageous to add them as an internal tester by giving them the technical role). The reviews don't take as long as a normal App Store review.

Alternatives (that don't involve a review) are Crashlytics Beta Distribution (owned by Twitter) or HockeyApp (owned by Microsoft). There are other services too, or you can host IPAs on your own website (using the mechanism designed for enterprise apps) but generally doing this means you miss out on other features you get when using the more integrated solutions.

Answer 2

Short answer: no. It is not safe to add testers with technical role.

Long answer:

According to iTunes Connect, the user must have Admin or Tech.
After reading the comments, I will complete my answer with this.

There are Internal Testers and External Testers.

External Testers are not available as of yet (see https://developer.apple.com/app-store/Testflight/).

Only Internal Testers are allowed by now (which means, your testers WILL be able to change your apps).
Since you need the user to have minimum rights, you should add the user as Technical (the less risky, but still dangerous). I see that there is a checkbox in iTC that lets you enable the Internal Tester role:

What permissions will the users have? Theoretically, they will only have access to the beta versions (but that is a guess, since I have not tried it yet). You could create an account for a fake internal tester and check that you can't modify apps with that role.