For most solo devs, the realistic catastrophe is not a sophisticated attacker. It is leaving your phone in a taxi. The phone has:
- Cached web sessions to every dashboard you use.
- A Tailscale node key with full mesh access to your home, work, and side-project servers.
- The 1Password / Bitwarden vault, often unlocked recently or with biometric quick-unlock.
- SSH keys in iSH or Termius.
- A Gmail tab open to your password-reset address.
What actually happens when a stranger picks it up
| Stage | Naive setup | Layered setup (after this quest) |
|---|---|---|
| 0–2 min: opportunistic finder snooping | Sees your dashboards if screen is unlocked | Sees your dashboards — but app has its own PIN |
| 2–10 min: malicious finder, lockscreen still active | Tries phone PIN; biometric may have lockout | Same |
| 10 min–2 hr: phone unlocked somehow (shoulder-surfed PIN, weak biometric) | Full Tailscale + every cached session | Tailscale yes; PIN-protected apps no |
| 2–6 hr: you notice and revoke | Damage already done | Damage limited to non-PINned surfaces |
Why "a strong phone PIN is enough" is wishful
It is a great defense — but it is a single defense. If the phone is unlocked when picked up (you were just using it; biometric was active; lockscreen widget exposes too much) it is bypassed instantly. Layered auth is what saves you when one layer fails.