Safe credential handover
Goal
Delivery often needs temporary access to your systems. Hand credentials over in a controlled way, then revoke them when
the work ends.
Do
- Prefer a password manager share, a one-time secret link, or an agreed secure vault.
- Create dedicated accounts for ForePath work when possible, with least privilege.
- Tell your technical contact which environment the access belongs to (staging vs production).
- Rotate or revoke access after acceptance or when the person leaves the engagement.
Do not
- Paste passwords, private keys, OTP seeds, JWTs, API keys, cloud tokens, or Stripe secrets into live chat,
[email protected], or ticket comments.
- Reuse personal admin accounts as the shared delivery login.
- Leave standing production admin access after handover is complete.
If a secret was exposed
1. Rotate the secret immediately on your side.
2. Revoke related sessions and keys.
3. Inform Support or your engagement contact that a rotation happened (without resending the secret).
4. Use [email protected] if the exposure is a security incident involving ForePath systems.
