Developers Should Sanitize Laptops and Phones Before Resale, Not Just Factory Reset

Developer machines often hold SSH keys, cloud credentials, environment files, and local database dumps that a standard factory reset may not remove. The article recommends revoking those secrets before wiping, since copied or synced credentials can remain trusted by remote services. It explains that NIST's updated SP 800-88 Rev. 2 guidance favors a Purge-level outcome for reusable devices, which on modern SSDs and phones usually means cryptographic erase or a firmware-level sanitize command rather than file overwriting. It also covers releasing ownership locks such as Apple Activation Lock, Android Google account removal, and corporate device enrollment, which commonly stall resales. The guidance stresses matching the sanitization method to the storage media rather than the operating system.