Lost or stolen developer laptop: first hour checklist

When a developer laptop goes missing, lock or wipe it if you can, then revoke every credential that lived on it: SSH keys, tokens, sessions and cloud access. Do the credential work even if the disk was encrypted, because encryption protects stored files, not sessions that were already open.

Minute 0 to 10: contain

Reach the owner and confirm what is known: when, where, was it locked, was it on.

• Windows. If Find My Device was turned on beforehand, sign in at account.microsoft.com/devices, locate the device and select Lock. Microsoft says to reset your password after it locks. This works only for signed in personal accounts with administrator type, and location must be on, so it is no help if nobody set it up.
• Mac. iCloud.com lists Locate, Play a sound, Lost Mode, Erase and Remove for a device. I could not confirm from Apple's overview page exactly what each does on a Mac, so check the current Apple guidance before you rely on a specific behaviour.
• Managed devices. If your organisation uses device management, issue lock or wipe from there.

Minute 10 to 30: cut access

1. Reset the identity provider password and revoke active sessions and refresh tokens for the user.
2. Remove the laptop's SSH keys. On GitHub, go to Settings, then SSH and GPG keys, and delete the key tied to the device. GitHub's guidance on possibly compromised keys applies directly.
3. Revoke personal access tokens, API keys and CLI logins the person used for source hosting, cloud accounts, package registries and CI.
4. Check for secrets in dotfiles and env files. If any production credential sat in a local file, rotate it. Do not wait to learn whether the disk was read.
5. Remove the device from MFA trust lists and from any VPN or Wi-Fi certificate allow list.

Minute 30 to 60: assess

• Was disk encryption on? Check your records for FileVault or BitLocker status. If you cannot show it was on, treat the data as exposed.
• What source code, customer data or credentials were stored locally?
• Does the loss trigger a contractual or regulatory notice? That is a judgement for your security and legal leads, not for this checklist.
• Report a theft to local police and your insurer if relevant. Microsoft's page recommends this, and notes the serial number appears under Info and support in your Microsoft account.

Afterwards

Write down what you could not do quickly. The gaps, such as no escrowed recovery key or no list of SSH keys per person, are your real findings. Review them in your next security steering committee.

Make the next one faster by keeping an inventory of which person has which keys, and by enforcing SSH key passphrases.

Quick check

Sources

• Find and lock a lost Windows device, Microsoft Support
• Locate a device, iCloud, Apple Support
• Reviewing your SSH keys, GitHub Docs

Last reviewed: 19 October 2026.