Set up your own access
Change the machine password after your first connection and add SSH public keys as needed. Each team member should use their own key. Remove a member’s key when they leave instead of continuing to share a team private key.
Enable only the connection methods your workflow needs. Check remote desktop and SSH access separately, and never paste connection details into public repositories or build logs.
Manage credentials and incidents in the console
Machine credentials are provided only through the console after you sign in. Don’t send passwords, private keys or complete connection credentials in pre-sales emails. Redact sensitive details from tickets too.
If you suspect credentials have been exposed, change the relevant passwords, remove unknown public keys and revoke external tokens first. Then provide your order number, instance details and the time period when the issue occurred.