Free tool · no account
Engineer offboarding checklist
When someone with production access leaves, removing their accounts is the easy half - every shared secret they could see needs rotating too. Pick the systems you use and get a checklist of what to revoke, rotate, and transfer, ready to print or paste into a ticket.
Offboarding: the departing person
First
- Disable their account in your identity provider (Okta, Entra ID, Google Workspace) first: it cuts every single-sign-on app at once.
- Write down every shared credential they could see - shared passwords, API keys, .env files, database logins. Removing access does not make anyone forget a secret, so each of these needs rotating.
- Check each system’s audit log for their activity in the last 30 days, before access is removed and while it is easy to correlate.
GitHub
- Remove them from the organization and from any repositories where they are an outside collaborator.
- Rotate Actions secrets, environment secrets, and deploy keys they could read or created.
- If the organization uses SAML single sign-on, revoke their authorized credentials (personal access tokens and SSH keys) from the organization’s people settings.
AWS
- Remove them from IAM Identity Center, or delete their IAM user’s console password and access keys.
- Rotate any shared access keys and secrets they could read.
- Review CloudTrail for their recent activity, including any IAM users, keys, or roles they created.
SSH servers
- Remove their public keys from authorized_keys on every server - and from the configuration management or images that put them there.
- Rotate shared SSH keys and passwords they knew.
- If you use an SSH certificate authority, add their certificates to the revoked keys list.
Databases
- Drop or lock their personal database users.
- Rotate shared application and admin database passwords they knew, and update the services that use them.
- Check for scheduled jobs or functions they own.
Password manager and shared vaults
- Remove them from shared vaults and collections.
- Rotate every credential in the vaults they could open.
Slack
- Deactivate their account.
- Review apps, bots, and incoming webhooks they installed or created, and give them a new owner where needed.
Finally
- Transfer ownership of anything that would break without them: repositories, cloud projects, scheduled jobs, dashboards, domains, and bots or integrations installed under their account.
- Recover company devices, and remove them from MDM and any device-based access.
- Record what was done and when. Auditors ask for exactly this.
Runs entirely in your browser. Nothing you enter is sent to Shortspan or saved, and no account is needed.
Next step
Shorter checklists next time
With Shortspan, credentials are brokered rather than copied, so removing someone from the workspace stops new releases immediately - and the audit log lists which servers, databases, and secrets were released to them, so you rotate those rather than everything.
Removing access does not remove knowledge
Disabling an account stops someone signing in. It does not change the database password, API keys, or SSH keys they saw while they worked there. Those need rotating, and the hard part is knowing which ones - which is why the checklist starts by listing them.
Order matters
Disable the identity provider account first: it cuts every single-sign-on app at once. Then remove direct accounts, rotate shared credentials, and transfer ownership of what would break without them - repositories, scheduled jobs, bots, and domains.
Common questions
- When should offboarding happen?
- Access should end when employment ends - for a contentious departure, at the moment notice is given. Rotation of shared secrets should follow the same day.
- Is anything I enter stored?
- No. The checklist is built in your browser; copy, download, or print it before you leave the page.
- Does this cover compliance requirements?
- It covers the technical steps auditors expect to see evidence of. Keep the completed checklist, with dates, as that evidence.
More free tools