coulomb/disaster-control
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
disaster-control/IncidentPlaybooks/credential-leak.md
tegwick d011073e16 Start DISCTL-WP-0002: policies, registers, runbooks, playbooks 
Expand AssetRegister and DataRegister with T0/T4 stack assets.
Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five
incident playbooks. Update README with mirror status. Mark T02-T05,
T07-T08 done; T01 and T06 in progress.
2026-07-07 20:04:54 +02:00

991 B
Raw Blame History

Playbook: Credential Leak

Triggers: token in Git/logs/chat, stolen laptop, exposed .env, compromised CI secret.

Steps

  1. Identify scope — which credential, which systems, exposure window.
  2. Revoke immediately — invalidate leaked token/password before cleanup discussion.
  3. Rotate downstream — every system that trusted the credential (OpenBao, Stripe, Gitea/Forgejo, backup drop, OpenRouter, webhooks).
  4. Scan for misuse — auth logs, Stripe dashboard, API usage anomalies, unexpected git pushes.
  5. Remove secret from exposure — git history scrub if committed; rotate not revert.
  6. Verify separation — confirm backup credentials still isolated (BackupPolicy.md CS-1).
  7. Re-deploy — refresh Kubernetes secrets via External Secrets / OpenBao.
  8. Document — incident note; no secret values in State Hub or evidence files.

References

AssetRegister.yaml T0 entries · PanicSheet.md §4 · ops-warden credential routing