Tailscale's biggest weakness for solo devs is also its UX strength: each device gets a long-lived key, and that key is valid until you revoke it. There is no automatic time-out. There is no "your phone hasn't moved in 30 minutes, are you sure?"
The three defenses you must set
| Defense | What it does | Where |
|---|---|---|
| Key expiry | Forces re-auth after N days (default 180 days, can be set as low as 1 day) | Admin → Settings → Keys |
| Device approval | New devices must be manually approved before joining | Admin → Settings → Device Approval |
| Lock screen on phone | Tailscale app inherits OS lock; if phone PIN is on, an attacker can't open the Tailscale UI | Phone settings |
What to actually do when a phone disappears
- Revoke the device in Tailscale admin. Login at
login.tailscale.comfrom any other device, find the phone, click "Remove". Within seconds it is out of the mesh. - Trigger Find My / equivalent. Lock or wipe the device.
- Revoke app sessions inside the tailnet. This is where Track 7's killswitch comes in: even before Tailscale revoke completes, your PIN-auth admin dashboard can
DELETE FROM security_sessionsfor every active row. Two layers, one click each. - Rotate downstream secrets. Anything the phone had cached (1Password vault, Gmail session, GitHub PAT) gets rotated separately.