How can I secure my remote box/user?

Depending on the skill of the "stranger", you cannot really be sure of anything. I'd either mirror his session and keep a watch on what he does, record the screen (how long is he going ot be working on this?). However, the best approach would be to create a virtual environment "sandbox" so he can play around and do his development work. Or have him do the development on his own machine and when he's done, he should hand off the work to you and you deploy it to the production machine.