What it covers
- Containment — Stop the bleeding — revoke, rotate, disable, roll back — before the investigation starts.
- Root cause — Behavioural testing against production plus repository and deploy history, even when the platform hides the deployed source.
- Remediation and write-up — The fix, the verification, and a plain-language post-mortem with what changes going forward.
How we work
Timeline kept from the first minute; every action logged; the report written for the owner, not the engineer.
