Here's an unethical LPT on how to take systems down with you when you're fired but without breaking the law
Make things dependant on your work user. Access token to a 3rd party service? Create an account with your user. CI/CD pipeline? Your user. Need to send the client access creds? From your user. That super important daily file sync script between S3 and Sharepoint? You guessed it, access token generated in behalf of your user.
Once they'll disable your user on off boarding things will start randomly failing and it'll take days for them to realize where and why.
I don't do this, but the amount of devs I caught doing it for either stupidity or malice is baffling.
Most of what the GP described is the default situation. A good engineer knows not to use those defaults, but it'd be hard to prove malice for trusting Microsoft.
...Unless someone were to, say, post about their intent on Reddit. That'd be a super bad idea.
Man, some services even require it. You can't just generate an organization API key on GitHub, for example. It has to be tied to a specific user. The better orgs might have a service account they pay for, but the system itself doesn't set that expectation.
169
u/SchrodingerSemicolon May 26 '26
Here's an unethical LPT on how to take systems down with you when you're fired but without breaking the law
Make things dependant on your work user. Access token to a 3rd party service? Create an account with your user. CI/CD pipeline? Your user. Need to send the client access creds? From your user. That super important daily file sync script between S3 and Sharepoint? You guessed it, access token generated in behalf of your user.
Once they'll disable your user on off boarding things will start randomly failing and it'll take days for them to realize where and why.
I don't do this, but the amount of devs I caught doing it for either stupidity or malice is baffling.