tegwick
d011073e16
Expand AssetRegister and DataRegister with T0/T4 stack assets. Add ResiliencePolicy, PanicSheet, full-server-loss runbook, and five incident playbooks. Update README with mirror status. Mark T02-T05, T07-T08 done; T01 and T06 in progress.
18 lines
No EOL
991 B
Markdown
18 lines
No EOL
991 B
Markdown
# Playbook: Credential Leak
|
|
|
|
**Triggers:** token in Git/logs/chat, stolen laptop, exposed `.env`, compromised CI secret.
|
|
|
|
## Steps
|
|
|
|
1. **Identify scope** — which credential, which systems, exposure window.
|
|
2. **Revoke immediately** — invalidate leaked token/password before cleanup discussion.
|
|
3. **Rotate downstream** — every system that trusted the credential (OpenBao, Stripe, Gitea/Forgejo, backup drop, OpenRouter, webhooks).
|
|
4. **Scan for misuse** — auth logs, Stripe dashboard, API usage anomalies, unexpected git pushes.
|
|
5. **Remove secret from exposure** — git history scrub if committed; rotate not revert.
|
|
6. **Verify separation** — confirm backup credentials still isolated (`BackupPolicy.md` CS-1).
|
|
7. **Re-deploy** — refresh Kubernetes secrets via External Secrets / OpenBao.
|
|
8. **Document** — incident note; no secret values in State Hub or evidence files.
|
|
|
|
## References
|
|
|
|
`AssetRegister.yaml` T0 entries · `PanicSheet.md` §4 · ops-warden credential routing |