Incident response

Pause the smallest affected surface when there is an identifier mismatch, suspected credential/signer compromise, unknown external mutation, critical dependency or contract failure, privacy leak, incorrect public claim, or inability to reconcile expected and observed state.

Severity guide

Severity	Example	Initial action
Critical	Active fund loss, signer compromise, malicious contract/address publication	Stop affected value paths, protect remaining assets, verify through an independent channel
High	Personal-data exposure, verifier quorum compromise, incorrect settlement	Contain service/role, preserve evidence, reconcile affected users and obligations
Medium	Provider outage, indexing lag, bot takeover without value path	Disable affected integration, publish bounded status, recover credentials/state
Low	Cosmetic/public copy error without unsafe action	Correct, verify caches/surfaces, record lesson

Response sequence

Detect and declare: record time, reporter, affected system, known identifiers, and uncertainty.
Preserve: retain relevant logs, receipts, versions, hashes, and state without copying secrets into the incident record.
Contain: pause the smallest automation, route, role, signer, or public surface that stops further harm.
Reconcile: independently query provider, database, chain, escrow balance, obligations, and public state. Do not retry an ambiguous mutation.
Communicate: publish verified facts through an unaffected official channel, including what users should avoid.
Recover: rotate/revoke credentials, restore a verified build/state, exercise the affected path, and monitor for recurrence.
Close: record impact, receipts, user obligations, residual risk, corrective work, and a sanitized lesson.

Economic incidents

Reconcile gross funding, fee transfer, creator pool, every reserved claim, immediate/retained releases, unused balance, refund, and token balance. A contract pause freezes actions but does not erase creator obligations. Never classify project funding or recovered funds as revenue.

Identity/privacy incidents

Revoke provider tokens and sessions as needed, rotate the encryption key/pepper only under a migration plan, identify exposed fields and recipients, preserve legal notification timelines, and delete unnecessary incident copies. Do not place raw affected data in chat or tickets.

Recovery criteria

Service resumes only when the cause is understood or safely bounded, exact expected state matches observed state, compromised authority is removed, obligations are accounted for, the fix is verified independently, monitoring is active, and user communication is accurate.

The root INCIDENT_RUNBOOK.md remains the concise operational source; this page provides the GitBook-facing procedure.