coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Start DISCTL-WP-0002: policies, registers, runbooks, playbooks

Browse source 
Expand AssetRegister and DataRegister with T0/T4 stack assets.
Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five
incident playbooks. Update README with mirror status. Mark T02-T05,
T07-T08 done; T01 and T06 in progress.
This commit is contained in:
tegwick 2026-07-07 20:04:54 +02:00
parent 4288ad21a9
commit d011073e16
13 changed files with 814 additions and 29 deletions
Download patch file Download diff file Expand all files Collapse all files

18
IncidentPlaybooks/credential-leak.md Normal file
View file

@ -0,0 +1,18 @@
# Playbook: Credential Leak
**Triggers:** token in Git/logs/chat, stolen laptop, exposed `.env`, compromised CI secret.
## Steps
1. **Identify scope** — which credential, which systems, exposure window.
2. **Revoke immediately** — invalidate leaked token/password before cleanup discussion.
3. **Rotate downstream** — every system that trusted the credential (OpenBao, Stripe, Gitea/Forgejo, backup drop, OpenRouter, webhooks).
4. **Scan for misuse** — auth logs, Stripe dashboard, API usage anomalies, unexpected git pushes.
5. **Remove secret from exposure** — git history scrub if committed; rotate not revert.
6. **Verify separation** — confirm backup credentials still isolated (`BackupPolicy.md` CS-1).
7. **Re-deploy** — refresh Kubernetes secrets via External Secrets / OpenBao.
8. **Document** — incident note; no secret values in State Hub or evidence files.
## References
`AssetRegister.yaml` T0 entries · `PanicSheet.md` §4 · ops-warden credential routing