Practice this once when nothing is wrong. Drilled, it is a 5-minute drill. Improvised, it is a 2-hour scramble while the threat clock ticks.
The sequence
| Minute | Action | Why first |
|---|---|---|
| 0–1 | Open laptop, navigate to your bookmarked admin page, click "Revoke All" | Cuts every cookie session immediately; cheapest broadest defense |
| 1–2 | Tailscale admin: find the phone, click "Remove" | Phone falls out of the mesh; even SSH (if it had it) stops working |
| 2–4 | Find My iPhone / Find My Device: lock the phone (don't wipe yet) | Lockscreen reduces opportunistic access; wipe eliminates evidence/recovery options |
| 4–6 | 1Password / Bitwarden admin: lock all sessions, review autofill events | Vault was the one thing that could log into everything else |
| 6–8 | Email: revoke any "logged in here" sessions; rotate any password reset email if access is suspected | Email is the recovery channel for everything else; it's the crown jewel |
| 8–10 | Critical accounts: GitHub, hosting provider, banking — force re-auth or rotate tokens | These are the ones with real blast radius if compromised |
What NOT to do
- Don't immediately wipe. A wiped phone is unrecoverable for forensics ("what did they actually access before lock?"). Lock first, decide on wipe after.
- Don't tweet about it from the laptop you just used to revoke. If the attacker is monitoring your social, you've told them the window.
- Don't change the PIN to something easier "so I can log back in". The PIN is fine; the sessions were the problem.