Security Runbook

#If a credential is exposed

1. Revoke/rotate it immediately.
2. Remove it from active configuration.
3. Search repository history and deployment logs.
4. Determine exposure scope.
5. Review affected authentication/integration activity.
6. Replace the secret with a newly generated value.
7. Document the incident.

#If unauthorized issue access is reported

user identity
project membership
role/permission
issue visibility
API authorization
audit history

Do not rely solely on frontend state when investigating access control.