Mfcttrf

I'm an European software developer and I am changing company. To do my job, during the years I have received (from my boss and colleagues) a lot of secrets, like:

• root accounts passwords (eg. AWS, Google Cloud, Azure, ...)


• access to servers (passwords and/or SSH keys)


• company-wise online accounts credentials (eg. GitHub, elearning platforms, ...)


• API keys

Clearly, anyone with this kind of information would be able to do nasty things, like accessing customer's data, or even deleting S3 buckets. That's needless to say that something like that would be huge for a small company.

To be clear: I do not want to fight/revenge my current company in any way. Despite my contract did not require me for a quit notice period, I proposed to stay one month after my announcement to prepare the team (document things, help hiring someone else, etc.). I even said to my boss and colleagues that they will be free to text me after my leave if they will need my help.

My boss initially was quite "fine" with my resignation; however during the last few days he started to act in a weird way to me (cold greetings, "forgetting" to CC me in some emails, ...). Maybe those things are just in my head, however I would like to protect me against any kind of future issues. What if one day a colleague of mine would accidentally destroy a database and to protect himself would blame me because I had the passwords?

Those access details are either stored on my company email (that I would lose access after quitting), on my computer (the policy is "bring your own laptop") or my Google account (I use "save password" in Chrome). That's not the best practices, but everyone else does the same. I will clearly clean my computer/accounts after quitting, but there will be no evidence that I did not print or memorize such secrets.

As a final note of mess, they will not be able to rotate keys/passwords in the short term (eg. the day next my quit). Some passwords have never been changed since the accounts were created, even after other employees left.

What would you do? Thank you in advance!

What would you do?

I would make a list of all these logins and offer to help the person who was tasked with changing all of them. As each password change was completed (by the other person, using passwords unknown to me), I would cross it off the list.

During my final month, I would send the updated list with each of my weekly status reports, and then the final list on my last day.

If any remained unchanged, I would rest easy, knowing that I gave them a month along with everything they needed to get the job done.