Operations

Incident response

Follow the Incident response operator checklist with on-call. Never wipe databases during an incident.

• SEV1: Parent exposure, checkpoint bypass, live billing corruption.
• Preserve logs and commit SHAs; freeze live unlocks if crypto is in doubt.
• Verify trust boundaries: no Stripe on NTKA; PostgREST anon denied on product tables.
• Write a timeline and update the runbook after action.