​

Security incident response

Use this guidance when you believe Starfire account access, a developer credential, integration secret, or organization resource may be compromised.

​

1. Reduce access first

Take the narrowest immediate containment action available:

• revoke a suspicious session
• rotate/revoke an exposed API key
• disable a compromised webhook/integration credential
• remove unexpected organization access
• apply a security hold through authorized administration when necessary

Do not wait for perfect certainty before rotating a credential that is known to be exposed.

​

2. Preserve identifiers

Record the affected resource and relevant times:

• account
• session/device
• API key/application ID
• request IDs
• organization/project
• security event timestamps

Do not preserve the secret itself in incident notes.

​

3. Review impact

Determine what the affected identity could access:

• personal resources
• organization projects
• developer applications
• billing administration
• Control Center permissions

​

4. Recover authentication

Reset credentials or complete supported account recovery as appropriate. Review active sessions after recovery.

​

5. Review programmatic access separately

Password changes and session revocation do not automatically guarantee API keys, service accounts, or integration tokens were invalidated.

​

6. Escalate appropriately

If the issue appears to affect Starfire infrastructure, multiple unrelated users, or a platform vulnerability, use the private security/support path rather than publishing exploit details publicly.

​

7. Restore access deliberately

Remove temporary restrictions only after the compromised access path is closed and the intended owner/admin state is verified.