contain-security-incident

Guides the first response to a suspected or confirmed security incident, such as leaked credentials, unexpected access, an identity or key nobody created, or exposure of a service that should be private. Contain first, preserve evidence, find persistence, and protect legitimate workloads. Phrases like "credentials leaked", "someone created a user", "suspicious API calls", "this port is open to the internet", "compromised key".

License

MIT