Chapter 1
The first five minutes
- 01
Reproduce one safe action
Repeat only the smallest read or retry action. Do not repeat payment, deletion, provider connection or credential rotation until its existing state is known.
- 02
Classify the impact
Treat credential exposure, cross tenant access, incorrect billing and unauthorized scans as security incidents. Treat a bounded user interface failure as an operational incident unless new evidence changes that classification.
- 03
Assign one incident owner
Name one person who coordinates recovery, records decisions and confirms closure. Other contributors should report evidence through that owner to avoid conflicting changes.
Check before continuing
- Confirm production, staging or local environment
- Record time, account, project and request identifier
- Stop unrelated deployment and configuration changes
Chapter 2
Authentication and dashboard
- 01
Separate sign in from workspace loading
If sign in succeeds but the dashboard fails, inspect the authenticated profile request before changing provider settings. A missing organization should render onboarding, not a generic authentication error.
- 02
Verify tenant boundaries
Confirm that the selected organization and project belong to the current account. Never solve a loading error by weakening RLS or bypassing membership checks.
- 03
Restore the owned entry point
Confirm that sign in, sign out and retry routes remain on the Vybentis experience. Provider implementation details should not replace customer facing Vybentis identity or instructions.
Check before continuing
- Confirm the Vybentis session cookie is accepted
- Check the Neon Auth subject mapping and account record
- Verify organization membership and RLS scoped reads
Chapter 3
Scans and integrations
- 01
Do not convert a timeout into a pass
A blocked, incomplete or unavailable engine must remain visible in coverage. Retry with the same idempotency identity when the contract requires it.
- 02
Verify the customer action
After recovery, start one authorized public scan, open its state and confirm that the resulting report preserves target, scope and policy version.
- 03
Confirm provider truth
Show connected only after the provider callback and selected project binding are stored. Otherwise show the exact setup or unavailable state without inventing evidence.
- 04
Keep scanner signals separate
For dependency findings, verify the exact package and version before critical priority. Review CVSS severity, EPSS probability, CISA known exploitation, public reachability and evidence quality separately. For web performance, keep Lighthouse lab data separate from Chrome UX Report field data.
- 05
Configure the Google server key
Enable only PageSpeed Insights API and Chrome UX Report API on the web quality key. Use no application restriction for Cloudflare Worker requests and keep the API restriction enabled. Google Search Console must use a separate OAuth client with only the webmasters.readonly scope.
- 06
Keep provider redirects fail closed
Cloudflare provider requests must use manual redirect handling. Never enable automatic redirects for PageSpeed or Chrome UX Report because the Google key could be forwarded to another host. Provider diagnostics may contain only bounded error categories without target URLs, keys or response bodies.
Check before continuing
- Confirm target authorization and normalized URL
- Inspect queue state, worker attempt and terminal coverage
- Confirm Browser Run and axe evidence instead of inferring a pass
- Check provider callback, minimum scopes and selected project
Chapter 4
Recovery and follow up
- 01
Repeat the original flow
Use the same environment and authorized account that observed the incident. Confirm the complete customer action instead of relying only on a health endpoint.
- 02
Add a regression check
Add the smallest automated check that would have failed before recovery and now passes. Keep its scope tied to the identified cause and customer impact.
- 03
Close with remaining risk
Record any unverified dependency, temporary mitigation or follow up date. Do not label the incident closed while payment reconciliation or credential rotation remains pending.
Check before continuing
- Repeat the original flow in the affected environment
- Verify logs and metrics no longer show the failure
- Add a regression test and assign the follow up owner