Credentials on a developer laptop usually sit in about a dozen places: shell history, Git and Docker credential files, cloud CLI caches, kubeconfig, database password files, API client variables and exported browser captures. List them, check each against the table below, and replace long-lived values with sign-in flows that expire.
Why an inventory first
Teams often talk about secrets in repositories and forget the laptop. A laptop that signs in to Git, a registry, a cloud account, a cluster and a database holds credentials for all of them, written by tools you installed and forgot. When a laptop is lost or a developer tool is compromised, the question is always the same: what was on that machine? An inventory answers it in advance.
The checklist
| Place | What can be there | What to check |
|---|---|---|
| Shell history | Tokens typed in commands | Leading space and history settings |
| PowerShell history | Same, on Windows | PSReadLine filter |
| Git credential helper | Passwords in a plain text file if store is used | Cache or store |
| GitHub CLI | Token in a credential store or a plain text fallback | gh auth login |
| Docker config.json | Base64 registry logins | config.json |
| SSH keys and agent | Private keys, forwarded agents | Agent forwarding |
| AWS CLI files | Long-lived access keys | SSO instead of keys |
| Google ADC | Key files or login files | ADC on a laptop |
| kubeconfig | Static tokens | Credential plugins |
| Database password file | Plain text passwords | pgpass rules |
| API client variables | Shared values that sync | Local vs shared values |
| Browser captures | Tokens inside HAR files | HAR export |
| Project files | tfvars and env files | Terraform and global ignore |
How to run the audit in an hour
- Pick one laptop, your own, and open each location in the table.
- Write down every credential you find, what it opens, and when it was created.
- Mark each one as long-lived or short-lived. Long-lived ones are your fix list.
- Replace what you can with a sign-in that issues temporary credentials. AWS's IAM guidance recommends temporary credentials for people, and Google calls service account keys a risk, so those two are good first targets.
- Revoke anything unused, and rotate anything that was ever pasted into a chat, ticket or history file.
- Repeat for a teammate's machine, with their consent, to see whether habits differ.
Make it stick
One audit decays within months. Put the checklist into your onboarding document, so a new laptop starts clean. Add a short note on which tools give you a sign-in flow and which still need a stored token. Review the list when you adopt a new tool, since every new CLI adds another place a credential can land. Track one simple number, how many long-lived credentials remain on laptops, and watch it fall.
Where Safeguard fits
Safeguard works on the dependency and code side of your software: SBOM and dependency scanning, reachability analysis and policy gates. It does not store or manage credentials, so keep using your password manager, secrets manager or cloud identity for that. You can run a free scan of a project at gold.safeguard.sh/scan.
Try it yourself
Click through the inventory and notice how listing every component makes gaps visible, the same idea as listing every place a laptop keeps a credential.
Click through it at your own pace, or open it full screen.
Quick check
Is a full disk encryption setting enough?
It protects a lost, powered off laptop. It does not protect against malware running as you or a copied backup, so reduce what is stored.
Who should run this audit?
Each developer on their own machine, with a short guide from the security team.
What should I fix first?
Long-lived keys that open production or cloud accounts, then plain text files with passwords.
Sources
Last reviewed: 19 October 2026.
