Templates
Incident timeline:
All times in UTC. Add rows as things happen; never edit an earlier row, add a correction below it.
Summary
| Field |
Value |
| Incident lead |
|
| Opened |
|
| Leaked repository URL |
|
| Became public (first push) |
|
| Taken down |
|
| Status |
Open / Contained / Closed |
Timeline
| Time (UTC) |
Event |
Who |
Evidence |
| |
Repository first pushed public |
|
snapshot metadata.json |
| |
Leak reported / detected |
|
|
| |
Evidence snapshot taken |
|
evidence/<folder> |
| |
Secret scan complete: N findings |
|
secrets-report.json |
| |
First secret revoked |
|
|
| |
Last secret revoked |
|
|
| |
Repository deleted / takedown filed |
|
|
| |
Log review complete |
|
|
| |
Stakeholders notified |
|
|
Secrets
| Secret |
Type |
Used by |
New secret deployed |
Old one revoked |
By |
Seen used in window? |
| |
|
|
|
|
|
yes / no / logs unavailable |
Forks and copies
| URL |
Found |
Takedown filed |
Removed |
| |
|
|
|
Decisions
| Time (UTC) |
Decision |
Why |
By |
| |
|
|
|
Notifications
| Who |
When |
How |
By |
| Manager |
|
|
|
| Security |
|
|
|
| Legal |
|
|
|
| Client / data owner |
|
|
|
Follow-up actions
