Security incident response
Use this guidance when you believe Starfire account access, a developer credential, integration secret, or organization resource may be compromised.
1. Reduce access first
Take the narrowest immediate containment action available:
- revoke a suspicious session
- rotate/revoke an exposed API key
- disable a compromised webhook/integration credential
- remove unexpected organization access
- apply a security hold through authorized administration when necessary
Do not wait for perfect certainty before rotating a credential that is known to be exposed.
2. Preserve identifiers
Record the affected resource and relevant times:
- account
- session/device
- API key/application ID
- request IDs
- organization/project
- security event timestamps
Do not preserve the secret itself in incident notes.
3. Review impact
Determine what the affected identity could access:
- personal resources
- organization projects
- developer applications
- billing administration
- Control Center permissions
4. Recover authentication
Reset credentials or complete supported account recovery as appropriate. Review active sessions after recovery.
5. Review programmatic access separately
Password changes and session revocation do not automatically guarantee API keys, service accounts, or integration tokens were invalidated.
6. Escalate appropriately
If the issue appears to affect Starfire infrastructure, multiple unrelated users, or a platform vulnerability, use the private security/support path rather than publishing exploit details publicly.
7. Restore access deliberately
Remove temporary restrictions only after the compromised access path is closed and the intended owner/admin state is verified.
Never send active passwords, API keys, reset tokens, webhook secrets, or private keys to support as proof of the issue.
