Runbook — Incident Recovery

Use this for corruption, accidental deletion, credential exposure, malware, unauthorized publication, or loss of an only copy.

1. Stop affected automation and isolate the system without destroying volatile evidence.
2. Record detection time, affected artifact IDs, accounts, repositories, hashes, and last known-good state.
3. If credentials or personal data are involved, move details to a restricted incident record and rotate/revoke secrets.
4. Preserve logs and suspect artifacts in quarantine; do not copy them into the public wiki.
5. Identify an independent known-good backup and verify it before restoration.
6. Restore into an isolated destination, run checksum/Git/database checks, and repeat the relevant baseline milestone.
7. Re-enable services gradually with least privilege and constrained networking.
8. Publish a sanitized timeline, impact, root cause, recovery evidence, and preventive actions.

S0 security/privacy incidents require private handling first. Public issues must not contain exploit details that create immediate risk, secrets, or personal data.