Goal
Delivery often needs temporary access to your systems. Hand credentials over in a controlled way, then revoke them when the work ends.
Do
-
Prefer a password manager share, a one-time secret link, or an agreed secure vault.
-
Create dedicated accounts for ForePath work when possible, with least privilege.
-
Tell your technical contact which environment the access belongs to (staging vs production).
-
Rotate or revoke access after acceptance or when the person leaves the engagement.
Do not
-
Paste passwords, private keys, OTP seeds, JWTs, API keys, cloud tokens, or Stripe secrets into live chat, [email protected], or ticket comments.
-
Reuse personal admin accounts as the shared delivery login.
-
Leave standing production admin access after handover is complete.
If a secret was exposed
-
Rotate the secret immediately on your side.
-
Revoke related sessions and keys.
-
Inform Support or your engagement contact that a rotation happened (without resending the secret).
-
Use [email protected] if the exposure is a security incident involving ForePath systems.