Exposed access keys, caught overnight
01 · Signal
Access keys turned up in a shared company drive, in the middle of the night.
02 · Evidence
A file-sync tool had copied them there on its own.
03 · Options
Three containment steps, ready and filed for approval the same minute.
04 · Decision
The founder said yes to replacing the keys.
- Approved: replace the exposed keys.
- Also prepared: sign everyone out, remove the synced copy (still in progress).
- No step ran before a person said yes.
05 · Action
Replacing the keys was marked done at 00:40. The rest of the clean-up is still going.
06 · What the CEO got
Fix approved in 15 minutes. One person decided. Nothing ran before they did.
Replacing the keys is marked done on the record. The rest of the clean-up is still in progress, so the record stays open.
