Freelancer account hygiene in one evening

A freelancer loses work when invoice mail, the domain, or the code host can be recovered with someone else’s password. This is a queue for one evening. You only touch accounts that are yours.

This is not a penetration test, and it is not a promise that an incident will not happen.

Five accounts to start with

1. The mailbox that receives invoices and password resets. A second factor that resists phishing: a passkey or a hardware key. Keep SMS as a fallback only where the service has nothing else.
2. The domain registrar. The same second factor. The recovery address must not be a mailbox whose password sits in an old email or in a repository.
3. GitHub or GitLab. Second factor on. Tokens have an end date. Current repositories do not contain a .env file, a private key, or a database dump.
4. The password manager. The bank password and the mail password are different, and both live only there. A desktop file named “passwords” gets a deletion date.
5. The phone that recovers the rest. Screen lock, a SIM PIN, and the date you checked number-porting protection with the carrier.

Treat the Apple or Google account that resets the others as part of this list, not a footnote. Recovery codes live outside that same mailbox: a printout or the manager, not the mail you are protecting.

Three things people confuse with hygiene

• A copy that exists only on the same disk as the work. That is not a backup. The second place is unplugged, or it uses a password the laptop’s ransomware does not know.
• “The backup runs” with no date of the last successful restore of one file. A date, or a gap. Not “someday”.
• A client password saved in your manager as a password to something of yours. After the job you ask them to change any password that arrived by email or chat.

What this evening does not cover

A second company, someone else’s domain, a scan “to prove a point”, or a guarantee for an insurer. Someone else’s target needs the owner’s written permission and a separate scope: the baseline review.

If you want the checklist, a password policy, and a decision log instead of assembling this yourself, the 48h hygiene pack is 79 PLN gross. tomek.st invoices it, and the files follow payment. The order is the form on that page.