I have had a student request for a developer key in order to do a Senior Project developing a Canvas app. His intentions are good, and this seems like a worthy project, but I have concerns about doing this. If he creates an app (and presumably his instructor deploys it in the course), even though there is a permission-granting step for the other students to participate in the app, I just feel squishy about allowing this. His app would have access to ALL of that student's data, such as other courses they are in.
Have any of you let anyone have a developer key? Do you have any processes / procedures around who is allowed and who is not?