> ## Documentation Index
> Fetch the complete documentation index at: https://aidocs.ethanbragdon.icu/llms.txt
> Use this file to discover all available pages before exploring further.

# Security Incident Response

> Respond to exposed credentials, suspicious sessions, compromised developer integrations, or organization access concerns in Starfire AI.

# Security incident response

Use this guidance when you believe Starfire account access, a developer credential, integration secret, or organization resource may be compromised.

## 1. Reduce access first

Take the narrowest immediate containment action available:

* revoke a suspicious session
* rotate/revoke an exposed API key
* disable a compromised webhook/integration credential
* remove unexpected organization access
* apply a security hold through authorized administration when necessary

Do not wait for perfect certainty before rotating a credential that is known to be exposed.

## 2. Preserve identifiers

Record the affected resource and relevant times:

* account
* session/device
* API key/application ID
* request IDs
* organization/project
* security event timestamps

Do not preserve the secret itself in incident notes.

## 3. Review impact

Determine what the affected identity could access:

* personal resources
* organization projects
* developer applications
* billing administration
* Control Center permissions

## 4. Recover authentication

Reset credentials or complete supported account recovery as appropriate. Review active sessions after recovery.

## 5. Review programmatic access separately

Password changes and session revocation do not automatically guarantee API keys, service accounts, or integration tokens were invalidated.

## 6. Escalate appropriately

If the issue appears to affect Starfire infrastructure, multiple unrelated users, or a platform vulnerability, use the private security/support path rather than publishing exploit details publicly.

## 7. Restore access deliberately

Remove temporary restrictions only after the compromised access path is closed and the intended owner/admin state is verified.

<Warning>
  Never send active passwords, API keys, reset tokens, webhook secrets, or private keys to support as proof of the issue.
</Warning>