After a trip, review the devices and sessions signed in to your accounts, remove anything you do not recognise, update your laptop and phone, delete networks you joined, and rotate any secret you typed on an untrusted network. Do it within a day of getting back, before you reconnect to production.
Why bother
You cannot be sure what a shared network, a borrowed charger or a hotel room did to your devices, and most of the time the answer is nothing. A short, fixed review turns that doubt into a checked box. It also catches the more common problem: old sessions you forgot you created.
Step 1: review signed in devices
Google's help page explains that you can see computers, phones and other devices where you are or were recently signed in to your Google Account, and that if you are not sure a session is yours, you should sign out on it. GitHub lets you view the devices that have logged in and revoke sessions you do not recognise, under Settings and Sessions. Do the same for your identity provider, email, cloud console and chat tools.
Step 2: check keys, tokens and apps
On GitHub, review SSH keys and authorized OAuth apps. The docs recommend auditing SSH keys, deploy keys and authorized applications regularly. Steps are in How to revoke GitHub access after losing a laptop. Delete personal access tokens you created for the trip, and let short lived cloud credentials expire.
Step 3: update and look at the devices
- Install operating system and browser updates on laptop and phone.
- Look at installed profiles, extensions and apps you did not add.
- Forget Wi-Fi networks from hotels, airports and conferences.
- Check that disk encryption and screen lock are still on.
- Run any endpoint checks your company already requires.
Step 4: rotate what you exposed
If you typed a work password on a portal page, used a code on an unfamiliar network, or lost sight of a device, change that password and review recent sign ins. A shared password you typed into a conference chat is also worth rotating.
Step 5: tell someone about anything odd
Unexpected prompts, missing items or devices that behaved oddly should go to your security contact. A quick note costs little; a missed incident costs a lot.
Review table
| Area | Where to look | Action |
|---|---|---|
| Identity provider | Sessions and devices | Revoke unknown |
| Source control | Sessions, keys, tokens, apps | Delete unknown or unused |
| Cloud | Recent sign ins, access keys | Deactivate extra keys |
| Email and chat | Signed in devices | Sign out unknown |
| Laptop and phone | Updates, profiles, apps | Install, remove |
| Wi-Fi | Saved networks | Forget trip networks |
For managers
Ask travellers to report completion in one line. Keep the checklist in your travel policy; the one page template has a place for it. See also Conference travel security checklist.
Safeguard does not review personal accounts. Its dependency scanning, SBOMs and policy gates help confirm that what was merged during a trip still meets your rules. Try a free scan.
Quick check
How soon after returning should I do this?
Within a day, and before you reconnect to production systems.
Do I need to wipe my laptop after every trip?
Not usually. Wipe it if it was lost, handled by others, or behaved oddly, and always for loaner devices.
Sources
- See devices with account access, Google Account Help
- Viewing and managing your sessions, GitHub Docs
- Reviewing your SSH keys, GitHub Docs
Last reviewed: 19 October 2026.
