Which account would an attacker use to reach your code?

Part 1 — Posture. 18 minutes. Every account that can reach your code, your infrastructure or your customer data, in one table. Including the ones that only might count: the old device still signed in, the personal email that is the recovery address, the AI tool connected to your repos, the person who left. Then you rank them by what they unlock, and you name the weakest one.

Part 2 — Hardening sprint. 35 minutes. The fixes in the order that matters, not the order that is easy. Email first, because it is the account that resets the others. Then your code host, your hosting, your database, your domain registrar. Then recovery codes you can reach without your phone. Then four minutes on the laptop, including every .env sitting in your Downloads folder.

Part 3 — The lost-phone drill. 10 minutes. Your phone was stolen an hour ago and has not been wiped. Can you still get into your email? Your code host? Your password manager? Write the answers down. This is the row people most often get wrong — finding out now is the point of the drill.

And fourteen more rows for the things that do not fit in an hour, with a date column.

Nothing is scanned. Nothing is uploaded. Nothing phones home. You fill it in by hand and you keep it — it is a map of your weak spots and it should not be in a shared folder, including ours. We never see what you wrote.

Then much of part 2 is not yours to change, and that is the point. The last page is the same assessment written as a request to your IT or security team: your top five changes, in priority order, with one line on why each matters. In several organisations that is a more useful hour's work than changing your own settings, because it changes the setting for everyone.

This is the day-3 worksheet from the Kyna three-day programme, with the classroom parts taken out. Kyna teaches engineering teams — and the non-coders who work closely with them — to build with AI coding agents and ship the result safely to production. Kyna is said KEE-nuh.

Kyna is Emile Bosch — 25+ years in software development, team lead at organisations including Funda, IKEA and Europol — and Wouter de Vos, founder of the Codaisseur coding academy, where more than 1,500 developers were trained.

One person's accounts is an hour. A team that ships AI-written software to customers is three days, in your office, up to 12 people, on their own codebase.