Killswitches only work if they're reachable. Half the work happens months before the incident. Five things to pre-stage:
1. Bookmarks on every device
- Tailscale admin URL (
login.tailscale.com) - Your app's
/admin/securitypage - Apple ID / Google account security page (Find My)
- 1Password / Bitwarden admin
- GitHub security log
- Hosting provider's "active sessions"
Folder them as "🚨 Killswitches". Sync the folder via the browser so every laptop has them.
2. A second authenticated device
Your only laptop being asleep at home while you're abroad is a bad day. Make sure you can log into the admin page from at least two devices: a laptop and, e.g., a tablet. Test it monthly.
3. The recovery token (from Track 6)
Stored in 1Password, never typed. The "I'm locked out of my own admin" escape hatch.
4. Out-of-band 2FA for critical accounts
| Account | 2FA method | Why |
|---|---|---|
| Hosting provider (AWS, DO, etc.) | Hardware key (YubiKey) or app-based TOTP | SMS 2FA can be SIM-swapped; phone-as-2FA fails on lost phone |
| GitHub | Passkey or hardware key | Same reason |
| Google / Apple ID | Hardware key + recovery codes printed | Recovery channel for everything; needs the highest reliability |
| 1Password / Bitwarden | Different from the above (key #2) | Don't use the same key as the thing the vault unlocks |
5. The drill
Once a quarter, on a Saturday, do the drill. Sign out of everything, click your killswitch, verify nothing works. Then walk through recovery. The first time you do this you'll discover what's broken; subsequent times you'll be measuring how fast you can do it.