How to offboard a contractor without leaking keys

When a contractor leaves, the instinct is to remove them from the repository and move on. But they had your .env file. Removing their access to the place where the file lives does nothing about the copy on their laptop.

Job one: stop future access

In StoreEnv this is one command. The grant and every wrapped key are deleted at once, and each secret the person could read gets a new key so nothing they hold can open a later version.

$ storeenv revoke @bob

Job two: rotate what they saw

No tool can reach into someone's memory or clipboard. If a value was readable, treat it as known. StoreEnv marks those secrets "rotation due" and lists them, so the work is concrete:

• Open each provider's dashboard and create a new key.
• Put the new values in your env files.
• Push with a message such as "Rotate after offboarding".
• Delete the old keys at the provider.

Make the next one smaller

Give contractors the keys they need and an expiry date. Three keys for seven days is a much shorter rotation list than a whole production file forever.

$ storeenv invite @bob --role viewer --keys backend/.env.production:DB_HOST,DB_USER --expires 7d