I'm an European software developer and I am changing company. To do my job, during the years I have received (from my boss and colleagues) a lot of secrets, like:

• root accounts passwords (eg. AWS, Google Cloud, Azure, ...)
• access to servers (passwords and/or SSH keys)
• company-wise online accounts credentials (eg. GitHub, elearning platforms, ...)
• API keys

Clearly, anyone with this kind of information would be able to do nasty things, like accessing customer's data, or even deleting S3 buckets. That's needless to say that something like that would be huge for a small company.

To be clear: I want to leave my current employer on good terms. Despite my contract did not require me for a quit notice period, I proposed to stay one month after my announcement to prepare the team (document things, help hiring someone else, etc.). I even said to my boss and colleagues that they will be free to text me after my leave if they will need my help.

My boss initially was quite "fine" with my resignation; however during the last few days he started to act in a weird way to me (cold greetings, "forgetting" to CC me in some emails, ...). Maybe those things are just in my head, however I would like to protect me against any kind of future issues. What if one day a colleague of mine accidentally destroyed a database? To protect himself, would he blame me because I had the passwords?

Those access details are either stored on my company email (that I would lose access after quitting), on my computer (the policy is "bring your own laptop") or my Google account (I use "save password" in Chrome). Those are not best practices, but everyone else does the same. I will clearly clean my computer/accounts after quitting, but there will be no evidence that I did not print or memorize such secrets.

As a final note of mess, they will not be able to rotate keys/passwords in the short term (e.g. the day next my quit). Some passwords have never been changed since the accounts were created, even after other employees left.

What would you do?

I'm an European software developer and I am changing company. To do my job, during the years I have received (from my boss and colleagues) a lot of non-personal shared secrets, like:

• root accounts passwords (eg. AWS, Google Cloud, Azure, ...)
• access to servers (passwords and/or SSH keys)
• company-wise online accounts credentials (eg. GitHub, elearning platforms, ...)
• API keys

Clearly, anyone with this kind of information would be able to do nasty things, like accessing customer's data, or even deleting S3 buckets. That's needless to say that something like that would be huge for a small company.

To be clear: I want to leave my current employer on good terms. Despite my contract did not require me for a quit notice period, I proposed to stay one month after my announcement to prepare the team (document things, help hiring someone else, etc.). I even said to my boss and colleagues that they will be free to text me after my leave if they will need my help.

My boss initially was quite "fine" with my resignation; however during the last few days he started to act in a weird way to me (cold greetings, "forgetting" to CC me in some emails, ...). Maybe those things are just in my head, however I would like to protect me against any kind of future issues. What if one day a colleague of mine accidentally destroyed a database? To protect himself, would he blame me because I had the passwords?

Those access details are either stored on my company email (that I would lose access after quitting), on my computer (the policy is "bring your own laptop") or my Google account (I use "save password" in Chrome). Those are not best practices, but everyone else does the same. I will clearly clean my computer/accounts after quitting, but there will be no evidence that I did not print or memorize such secrets.

As a final note of mess, they will not be able to rotate keys/passwords in the short term (e.g. the day next my quit). Some passwords have never been changed since the accounts were created, even after other employees left.

What would you do?

I'm an European software developer and I am changing company. To do my job, during the years I have received (from my boss and colleagues) a lot of secrets, like:

• root accounts passwords (eg. AWS, Google Cloud, Azure, ...)
• access to servers (passwords and/or SSH keys)
• company-wise online accounts credentials (eg. GitHub, elearning platforms, ...)
• API keys

Clearly, anyone with this kind of information would be able to do nasty things, like accessing customer's data, or even deleting S3 buckets. That's needless to say that something like that would be huge for a small company.

To be clear: I do not want to fight/revenge my current company in any way. Despite my contract did not require me for a quit notice period, I proposed to stay one month after my announcement to prepare the team (document things, help hiring someone else, etc.). I even said to my boss and colleagues that they will be free to text me after my leave if they will need my help.

My boss initially was quite "fine" with my resignation; however during the last few days he started to act in a weird way to me (cold greetings, "forgetting" to CC me in some emails, ...). Maybe those things are just in my head, however I would like to protect me against any kind of future issues. What if one day a colleague of mine would accidentally destroy a database and to protect himself would blame me because I had the passwords?

Those access details are either stored on my company email (that I would lose access after quitting), on my computer (the policy is "bring your own laptop") or my Google account (I use "save password" in Chrome). That's not the best practices, but everyone else does the same. I will clearly clean my computer/accounts after quitting, but there will be no evidence that I did not print or memorize such secrets.

As a final note of mess, they will not be able to rotate keys/passwords in the short term (eg. the day next my quit). Some passwords have never been changed since the accounts were created, even after other employees left.

What would you do? Thank you in advance!

I'm an European software developer and I am changing company. To do my job, during the years I have received (from my boss and colleagues) a lot of secrets, like:

• root accounts passwords (eg. AWS, Google Cloud, Azure, ...)
• access to servers (passwords and/or SSH keys)
• company-wise online accounts credentials (eg. GitHub, elearning platforms, ...)
• API keys

Clearly, anyone with this kind of information would be able to do nasty things, like accessing customer's data, or even deleting S3 buckets. That's needless to say that something like that would be huge for a small company.

To be clear: I want to leave my current employer on good terms. Despite my contract did not require me for a quit notice period, I proposed to stay one month after my announcement to prepare the team (document things, help hiring someone else, etc.). I even said to my boss and colleagues that they will be free to text me after my leave if they will need my help.

My boss initially was quite "fine" with my resignation; however during the last few days he started to act in a weird way to me (cold greetings, "forgetting" to CC me in some emails, ...). Maybe those things are just in my head, however I would like to protect me against any kind of future issues. What if one day a colleague of mine accidentally destroyed a database? To protect himself, would he blame me because I had the passwords?

Those access details are either stored on my company email (that I would lose access after quitting), on my computer (the policy is "bring your own laptop") or my Google account (I use "save password" in Chrome). Those are not best practices, but everyone else does the same. I will clearly clean my computer/accounts after quitting, but there will be no evidence that I did not print or memorize such secrets.

As a final note of mess, they will not be able to rotate keys/passwords in the short term (e.g. the day next my quit). Some passwords have never been changed since the accounts were created, even after other employees left.

What would you do?