Product Security Incident Response
Status: TODO
Example incident classes
- stolen/leaked NATS device credential
- stolen/leaked VPN private key
- backend authorization bypass
- malicious control command execution
- compromised OTA signing infrastructure
- actively exploited product vulnerability
Minimum response flow
- detect / receive report
- preserve evidence
- identify affected devices/versions
- contain (revoke credentials / disable command path / network block)
- remediate
- release update
- notify affected stakeholders where required
- post-incident review