Detect, respond, and recover
Contain without destroying evidence
Limit ongoing harm, preserve useful evidence, and avoid impulsive changes that make the incident harder to understand.
8 minute lesson
Containment stops the damage from growing. It is not the same as immediately deleting every affected system.
Revoke exposed credentials, isolate compromised components, block known abuse, and preserve relevant logs and snapshots. Record each action and time. Coordinate destructive steps with the incident lead so recovery and investigation remain possible.
A stolen deployment token is still creating releases. Deleting the build history stops the visible activity but destroys the timeline and leaves the token valid.
Containment may temporarily stop deployments. Revoke the credential first, preserve provider events, and use a separate recovery identity for urgent fixes.
Order the containment actions for a stolen deployment token and run them with a disposable token. Prove the token can no longer deploy while its safe identifier and activity history remain available.
Lesson completed