Name a deputy who receives alerts while you are away, route exploited-vulnerability and secret alerts somewhere they will notice, and write a short away rule saying what can wait and what cannot. Without this, a one-person project has no coverage for days or weeks at a time.
The gap solo maintainers forget
A team has natural cover. A solo developer has silence. Alerts continue during a holiday, illness or a busy month, and the next person to read them is you, later. For a project with users, that gap is where an exploited issue sits unnoticed.
Three pieces of cover
| Piece | What to set up |
|---|---|
| Deputy | One trusted person with access to the repository settings and the deploy path |
| Alert route | Alerts sent to an address or channel the deputy also sees |
| Away rule | One paragraph: what the deputy may do without asking |
The away rule, in plain terms
Keep it short and specific. For example: the deputy may rotate any leaked credential, disable a compromised account, roll back a release, and merge an update pull request for a package with an exploited vulnerability if tests pass. The deputy should not do large upgrades or change architecture. Writing this down avoids a stressful call to the beach.
Know what silence does to automation
GitHub documents that if maintainers stop interacting with Dependabot pull requests, Dependabot temporarily pauses updates. So an unattended repository misses your attention, and its automation may go quiet too. Plan for a catch-up session on return, and check that updates resume.
Make exploited issues loud
During your weekly routine you compare new items to the CISA exploited list. When you are away, the deputy does that check. Give them the link and the product list from your inventory so the work takes ten minutes.
Access without sharing passwords
Give the deputy their own account with the access they need. Never share a personal login. Revoke the extra access when you return, or keep it deliberately and review it every quarter.
The return checklist
- Read everything that arrived.
- Check that Dependabot is active again.
- Review what the deputy changed.
- Update the register.
- Thank the deputy.
Quick check
What if there is no one I can trust as a deputy?
Reduce exposure before you leave: pin a stable version, pause nonessential deployments, and add a notice that response may be slow. A maintained fallback beats none.
Should the deputy have production access?
Just what the away rule needs. Least privilege applies to your deputy too.
Safeguard policies, guardrails and agent identity controls can scope what automated and human helpers may do, and the free scan is at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
