Who holds what, and how.
WHAT EXISTS ON A VPS
Root password SSH private keys Control panel credentials Database passwords Application administrator accounts API keys and tokens Backup storage credentials
STORING THEM
A password manager, for everything. Never a text file on the server, never an email thread, never a message.
SSH keys live on individual machines and should be passphrase-protected.
SHARING ACCESS
Each person gets their own account and their own SSH key. Never share a private key or the root password.
This means access can be revoked individually, and actions are attributable.
ROTATION
Change credentials when someone leaves, when a device is lost, or when you suspect exposure.
Rotate routinely at least annually.
WHAT TO DO WHEN SOMEONE LEAVES
Remove their user account, which removes their key Change any shared credential they knew Revoke API tokens they held Check for keys they may have added to other accounts
THE COMMON FAILURE
A developer's key still in authorized_keys three years after the engagement ended.
