Appendix C · Incident record template
The Secret Leak Field Manual · 3 min read
Copy this whole file per incident. Fill every field with what is known at the time; write "unknown" rather than guessing — the record's value is precision, and unknowns mark the audit work. Masked values only, everywhere, always.
Header
| Field | Entry |
|---|---|
| Incident ID / ticket | |
| Date opened (UTC) | |
| Severity rating + one-sentence rationale | From the Chapter 3 rubric |
| Incident lead | Name and role |
| Responders | Names and roles |
| Status | Open / contained / closed |
The credential
| Field | Entry |
|---|---|
| Provider and class | e.g. Stripe restricted key (rk_live_) |
| Masked value | First 8 + last 4 only: rk_live_…XXXX |
| Fingerprint / hash | If tooling produced one |
| Scope model | What the credential can reach |
| Created on | Provider console date |
| Revoked/rotated on | Timestamp from Chapter 6 playbook |
| Attribution notes | e.g. "Stripe or Clerk shape; confirmed Stripe" |
Discovery
| Field | Entry |
|---|---|
| Found by | Internal scan / external report / usage anomaly / other |
| Found where | Chapter 1 surface number(s) + exact location (URL, log path, commit) |
| Found when | UTC timestamp |
| Evidence attached | Screenshot paths, report links (masked) |
Exposure window
| Field | Entry |
|---|---|
| Earliest plausible exposure | Best-evidenced estimate + how derived (commit date, deploy date, retention window) |
| Revocation time | UTC |
| Window length | For the audit in Chapter 5 |
| Usage anomalies found | What, where observed, timestamps; or "none found" + which logs were checked |
Actions ledger
| Time (UTC) | Action | Owner | Notes |
|---|---|---|---|
| Record opened | |||
| Classified | |||
| Replacement staged | |||
| Rotation deployed | |||
| Old credential revoked | |||
| Artifacts rebuilt + caches purged | |||
| Copies swept (list each location) | CI vars · vault · .env files · previews · trackers | ||
| Old key verified dead | Method + result | ||
| Deployed surface rescanned clean | Tool + timestamp |
Copies disposition
| Location | Disposition | Cleaned / scheduled / accepted-with-reason |
|---|---|---|
| Production bundle | ||
| Preview deployments | ||
| CI variables/contexts | ||
| Local machines | ||
| Third parties/vendors | ||
| AI sessions/tools |
Disclosure
| Field | Entry |
|---|---|
| Counsel consulted | Y/N, when |
| Processor/platform notified | Who, when (payment-class exposures notify the processor as routine) |
| Customers affected / notified | Facts established from usage audit, not assumptions |
| Regulatory analysis status | Owned by counsel |
Root cause and changes
State the cause structurally ("the value wore a public env prefix", "CI job printed environment"), never personally.
| Change made | Prevents which recurrence | Ticket |
|---|---|---|
Open items at closure
- [ ] Every copy dispositioned
- [ ] Audit window fully covered by retained logs
- [ ] Structural fix shipped and verified by rescan
- [ ] Drill scheduled to test this incident's lessons