Treat a hotel room as unattended, not secure. What protects your data is a strongly encrypted disk, a strong login password, a laptop that is fully shut down or locked, and no standing secrets on it. Hiding the machine or trusting a room lock is a weak defence on its own.
The threat in plain terms
Leaving a laptop in a room raises two different risks. The first is theft: someone takes the device. The second is tampering: someone with time alone with it tries to read data or change it. Both are low probability for most trips, but the first is the most common reason developers lose a machine, so plan for it.
The right question is not "can anyone get in the room?" but "what would they get if they had the laptop for an hour?"
What actually protects the data
- Full disk encryption. Apple says that on a Mac with Apple silicon or an Apple T2 Security Chip, data is encrypted automatically, and that turning on FileVault keeps someone from decrypting or accessing your data without your login password. On Windows, BitLocker serves the same role, and Linux has LUKS. Check that it is on, not assumed.
- A strong login. Encryption is only as good as the password that unlocks it. Use a long passphrase, not a short PIN.
- Shut down, not sleep. A powered off, encrypted laptop is much harder to attack than one asleep with keys in memory. If you leave it in the room, shut it down.
- A screen lock with a short timeout, for the times you step away in a lobby or cafe.
- No standing secrets. Keys, tokens and
.envfiles you do not need for the trip should not be on the machine. See Should developers travel with production access?.
Recovery keys
Encryption introduces a recovery question. Apple warns that if you turn on FileVault, forget your login password and also forget your recovery key, you will lose your files and settings forever. Keep the recovery key somewhere other than the encrypted disk and not in the same bag. The guide Where to store recovery keys for encrypted laptops has options.
What is not worth much
| Habit | Value |
|---|---|
| Hiding the laptop in a drawer | Low |
| Do Not Disturb sign | Low |
| Hotel room safe | Depends on the safe, and staff may have override access |
| Cable lock in a room | Small, deters opportunists only |
| Encrypted disk plus shutdown | High |
Do not rely on a room safe as your only control. If the laptop is that valuable, carry it with you or leave it off the trip.
If you suspect it was touched
Signs include a different position, a missing seal, or an unexpected login prompt. Do not enter your password on a suspicious screen. Contact your security lead, treat the device as untrusted, and use another one for work. The steps in Lost or stolen developer laptop: first hour checklist apply if it is gone.
Safeguard does not manage devices. It covers dependency scanning, SBOMs and policy gates for code. A free scan can show what your repositories depend on while you are away.
Quick check
Is sleep mode fine if the disk is encrypted?
Shut down is safer, because a sleeping laptop may keep keys in memory. Use shutdown when you leave it unattended for hours.
Should I carry the laptop to dinner?
If it holds sensitive data and you cannot shut it down and trust the disk encryption, carrying it is simpler. Otherwise shut it down and leave it.
Sources
Last reviewed: 19 October 2026.
