Skip to main content
Work through these steps in order. If you think the computer or remote running Hoista is compromised, do steps 2 to 4 from another device, using your providers’ own dashboards.

​
1. Cut off every agent

In Settings → Safety, choose Cut off every agent, or run:
Every agent loses access, agent access is paused and waiting connection requests are dropped. Your projects keep running. This doesn’t revoke provider tokens or cancel changes a provider already accepted.

​
2. Revoke what may have leaked

​
3. Check what happened

  • Read activity in Agents and in each project’s Overview.
  • Check hoist operations for changes Hoista didn’t hear back about.
  • Check hoist webhooks deliveries WEBHOOK_ID for unexpected events.
  • Check each provider’s own audit log for new resources, changed domains or variables, new tokens and unexpected spend. Someone who controlled Hoista could have changed its history.
Write down times, agent IDs and operation IDs before you clean anything up.

​
4. Recover

  1. Reinstall Hoista from a release you trust, or set up a new remote.
  2. Restore a backup you’ve checked, and reconnect providers with new tokens.
  3. Connect only the agents you need, at View only first.
  4. Answer any unclear changes before you let agents make new ones.

​
5. Confirm it worked

Check that old tokens fail at the provider, revoked agents can’t connect, and only your own devices appear on your remote’s devices page. To be ready next time, keep a second passkey, backups on another disk and a way to sign in to each provider without Hoista.

Agent permissions

Change or narrow what an agent can do.

Credential storage

Where tokens are kept.

Backups and recovery

Back up Hoista and settle unclear changes.