Operator guidance · Human-led

Respond carefully. Verify with evidence.

FixLoop helps operators reason through a security incident, preserve evidence, and plan a verified recovery. It recommends and records decisions; it does not blindly execute destructive or production-changing actions.

Contain only with authority

Isolation, firewall changes, and account lockdown can affect service availability. Confirm authorization and scope.

Preserve before cleanup

Do not erase potentially useful evidence just to make an alert or suspicious file disappear.

Verify the exact scope

A passing test or source scan is not proof that production is recovered or an attacker has lost access.

INCIDENT RESPONSE LIFECYCLE

Five stages. Human decisions at every critical step.

Contain the threat

If there is credible evidence of active compromise, limit further harm using approved controls.

Identify the affected service, account, environment, and likely blast radius.
Consider approved hosting, firewall, identity-provider, or network controls.
If an urgently vulnerable service cannot be patched promptly, an authorized operator may decide isolation is necessary.

Human decision required

Who authorizes the control, what is the blast radius, and how will containment be verified?

Preserve evidence

Preserve enough context to investigate the event before wiping or redeploying over useful evidence.

Save relevant logs, timestamps, deployment IDs, source revisions, alerts, and account events.
Record who collected each item and when; preserve access and retention details.
Avoid deleting suspicious files or wiping systems unless urgent containment requires a faster action.

Human decision required

Which sources must be preserved, by whom, and for how long?

Protect credentials and access

Use a trusted device and approved admin process to reduce the risk of continued unauthorized access.

Revoke exposed tokens and rotate potentially compromised credentials.
Review administrator accounts and service identities; invalidate affected sessions.
Check where the same credential was used. Never paste secrets into issues, prompts, or CI logs.

Human decision required

Which credentials and identities are in scope, and how will revocation be confirmed?

Patch and rebuild safely

Remove the vulnerable behavior and check for persistence or unauthorized changes.

Apply the vendor fix or a small reviewed patch, with a regression test.
Check for persistence and unauthorized modifications; rebuild from trusted sources when needed.
Review the diff and compatibility/security impact before merging or deploying.

Human decision required

Has a reviewer approved the patch and the rebuild plan?

Verify recovery

Verify the tested change, deployed version, and relevant operational signals separately.

Run regression and relevant security tests; record the pipeline and commit SHA.
Check access controls, logs, deployed version, and monitoring for recurrence.
Document unresolved uncertainty and consider applicable reporting/notification requirements.

Human decision required

Who signs off that the system can safely return to service?

Actions FixLoop will not perform automatically

This guidance does not authorize FixLoop to isolate a live service, revoke/rotate credentials, delete data or evidence, approve or merge code, or deploy to production. Each action requires an authorized operator, an explicit decision, and a plan to verify the result.

EVIDENCE RECORD

What to record before closing an incident

Finding ID/fingerprint and affected asset

Timestamped evidence and collection source

Observed fact vs. risk hypothesis

Approver and containment/change outcome

Test output, pipeline URL and commit SHA

Before/after status and unverified scope

Follow your organization's incident-response process and applicable reporting requirements. This runbook is operational guidance, not a substitute for a designated incident commander or legal/security advice.