Developer laptop offboarding checklist for leavers

When a developer leaves, disable their identity provider account first, then revoke SSH keys, tokens and sessions, then collect and wipe the laptop. Order matters, because a returned laptop is only one of many places credentials live. The device is the last step, not the first.

Before the last day

• Inventory what the person can reach. Source hosting, cloud consoles, package registries, CI, secrets managers, monitoring, customer support tools.
• Check who owns shared credentials. Anything the leaver knew and that is shared must be rotated.
• List which devices they use, including any personal ones that touched company data.

You can only offboard what you can list. If you cannot, that gap is the first fix. See the BYOD decision guide.

On the last day, in this order

1. Disable the identity provider account and revoke sessions and refresh tokens. This cuts most access in one step.
2. Remove SSH keys from your Git host and servers. On GitHub, keys appear under Settings, SSH and GPG keys for the user's own account. For company accounts, check organisation level key listings and deploy keys. GitHub's guidance on reviewing keys is to delete ones you do not recognise or that are out of date.
3. Revoke personal access tokens, API keys and OAuth app grants tied to the person.
4. Transfer ownership of repositories, cloud resources, scheduled jobs and on call rotations.
5. Rotate shared secrets they knew.
6. Remove them from MFA enrolments, VPN and Wi-Fi certificate lists.
7. Review recent activity for unusual downloads or clones in the weeks before departure, if your tools show it and your policy and local law allow it.

The device

For a company laptop:

• Collect it, then wipe it using your management tool or the operating system's reset, and confirm the disk was encrypted before wiping.
• Retire its recovery key from your records only after the wipe. See recovery key storage.
• Record the serial number, date and who did the wipe.

For a personal laptop, you cannot wipe it, so you rely on agreement and design. Ask the person to delete company repositories and credentials and confirm in writing. Better, avoid the problem by keeping code in managed workspaces. Check with legal counsel on what you may ask and monitor.

After they have gone

• Watch for sign in attempts on the disabled account.
• Check that no API key or token the person created is still in use. Look for ones that were not rotated.
• Keep the offboarding record. It helps with audits and questionnaires.

Make the next one easier

Per person key lists, one key per device and escrowed recovery keys turn this from a scramble into a checklist. See the remote work baseline.

Quick check

Sources

• Reviewing your SSH keys, GitHub Docs

Last reviewed: 19 October 2026.