Yes, I agree on both accounts. We are working on getting payment from them. And we did develop this on a staging server first. It was originally a very small application. However, once it was installed on their server, changes were made and it grew in size. I should have known better.
I am assuming that I can not protect future work with an external require file or authentication of some kind? I don't even know what that would be called if it did exist, so I am having trouble searching for it.