Agent WranglersTKO-1Required
Take control of every account before touching the code
Before the first change, list every account the product depends on. Give the company at least two admins on each, and remove every person who has left.
How to do it
Inherited products often run on a founder's personal email, an agency's cloud account or a builder seat nobody pays for. Whoever holds those accounts can delete the product or read its data. The list covers the code host, the cloud or hosting account, the domain registrar and DNS, and the database. It also covers the email sender, the payment provider, the AI builder, the app stores, analytics and the error tracker. Move the domain as Own the domain and DNS in your own accounts says. Protect the code host as Protect the accounts that can change the code says. Remove former staff and contractors by the deadline in Remove access within a day of leaving.
How to check
The access list names every account in the list above that the product uses. Each has at least two current company admins who can sign in, and no member who is not on the current staff or contractor list.
Sources
Related rules
- INF-68 Own the domain and DNS in your own accounts in Infrastructure and environments
- ENG-20 Protect the accounts that can change the code in Engineering
- CMP-30 Remove access within a day of leaving in Compliance and governance
- TKO-2 Rotate every secret the previous team could read in Codebase takeover
- TKO-7 Fix in risk order in Codebase takeover
- TKO-27 Build the product from the company's own repository in Codebase takeover
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/codebase-takeover/triage/take-control-of-accounts">Agent Wranglers codebase takeover playbook</a>. In code you write, add a comment next to it with the same link.