code/cl8y-dex-terraclassic

Fork 0

Security: no emergency communications templates for pause, blacklist, exploit, false alarm, or postmortem [SEC-G05] #438

New issue

Closed

opened 2026-06-29 16:12:21 +00:00 by totdking · 8 comments

totdking commented

2026-06-29 16:12:21 +00:00

(Migrated from gitlab.com)

No description provided.

totdking commented

2026-06-29 16:13:37 +00:00

(Migrated from gitlab.com)

Summary

The incident template (docs/templates/incident-dex-indexer.md) has a Communications section with two blank fields: Internal: and Public: (if any). No pre-filled, copy-pastable text templates exist for any of the five communications scenarios required by SEC-G05: trading paused (user-facing announcement), wallet/token/pair blacklisted (compliance notice), exploit under investigation (interim user notice), false alarm retraction, or postmortem summary. The user-incident-faq.md provides user-facing background information but is not a communications template and is not copy-pastable for per-incident comms.

What Was Checked

docs/templates/incident-dex-indexer.md Communications section: contains only Internal: and Public: (if any) -- both blank. No template text.
docs/user-incident-faq.md: general background FAQ for traders/LPs. Not a per-incident communications template. No scenario-specific fill-in-the-blank copy.
All docs files searched for "template", "paste", "announcement", "comms", "postmortem": only the incident template references these concepts with blank fields.

Expected (per checklist)

Docs must include ready-to-paste communications templates for:

(1) pair paused -- user-facing notice with pair address, impact, and estimated timeline;

(2) wallet/token/pair blacklisted -- compliance notice with reason (if disclosable);

(3) exploit under investigation -- interim user notice preserving user confidence while investigation continues;

(4) false alarm retraction -- retraction notice after a wrongful pause or blacklist;

(5) postmortem -- structured summary of what happened, affected users, and follow-up actions.

Actual

The Communications section of the incident template is blank. Operators must compose all public and internal comms from scratch during an incident under time pressure. No scenario-specific templates exist.

Evidence

docs/templates/incident-dex-indexer.md Communications section: Internal: and Public: (if any) -- both blank
docs/user-incident-faq.md: background FAQ, not incident-specific templates
No other doc contains paste-ready communications copy for any scenario

Suggested Fix

Add a Communications templates appendix to docs/templates/incident-dex-indexer.md with five fill-in sections: (1) pair paused; (2) blacklist applied; (3) exploit under investigation (interim); (4) false alarm retraction; (5) postmortem. Each template should include placeholder fields for: pair address or wallet address, impact description, timestamp, estimated resolution time or completed actions, and contact channel.

Verification Checklist

Incident template or linked doc includes a paste-ready template for: pair paused announcement
Incident template or linked doc includes a paste-ready template for: blacklist applied notice
Incident template or linked doc includes a paste-ready template for: exploit under investigation interim notice
Incident template or linked doc includes a paste-ready template for: false alarm retraction
Incident template or linked doc includes a paste-ready template for: postmortem summary

Labels

security, pre-launch

Cc: @PlasticDigits

### Summary The incident template (`docs/templates/incident-dex-indexer.md`) has a **Communications** section with two blank fields: `Internal:` and `Public: (if any)`. No pre-filled, copy-pastable text templates exist for any of the five communications scenarios required by SEC-G05: trading paused (user-facing announcement), wallet/token/pair blacklisted (compliance notice), exploit under investigation (interim user notice), false alarm retraction, or postmortem summary. The `user-incident-faq.md` provides user-facing background information but is not a communications template and is not copy-pastable for per-incident comms. --- ### What Was Checked - `docs/templates/incident-dex-indexer.md` Communications section: contains only `Internal:` and `Public: (if any)` -- both blank. No template text. - `docs/user-incident-faq.md`: general background FAQ for traders/LPs. Not a per-incident communications template. No scenario-specific fill-in-the-blank copy. - All docs files searched for "template", "paste", "announcement", "comms", "postmortem": only the incident template references these concepts with blank fields. --- ### Expected (per checklist) Docs must include ready-to-paste communications templates for: (1) pair paused -- user-facing notice with pair address, impact, and estimated timeline; (2) wallet/token/pair blacklisted -- compliance notice with reason (if disclosable); (3) exploit under investigation -- interim user notice preserving user confidence while investigation continues; (4) false alarm retraction -- retraction notice after a wrongful pause or blacklist; (5) postmortem -- structured summary of what happened, affected users, and follow-up actions. --- ### Actual The Communications section of the incident template is blank. Operators must compose all public and internal comms from scratch during an incident under time pressure. No scenario-specific templates exist. --- ### Evidence - `docs/templates/incident-dex-indexer.md` Communications section: `Internal:` and `Public: (if any)` -- both blank - `docs/user-incident-faq.md`: background FAQ, not incident-specific templates - No other doc contains paste-ready communications copy for any scenario --- ### Suggested Fix Add a **Communications templates** appendix to `docs/templates/incident-dex-indexer.md` with five fill-in sections: (1) pair paused; (2) blacklist applied; (3) exploit under investigation (interim); (4) false alarm retraction; (5) postmortem. Each template should include placeholder fields for: pair address or wallet address, impact description, timestamp, estimated resolution time or completed actions, and contact channel. --- ### Verification Checklist - [ ] Incident template or linked doc includes a paste-ready template for: pair paused announcement - [ ] Incident template or linked doc includes a paste-ready template for: blacklist applied notice - [ ] Incident template or linked doc includes a paste-ready template for: exploit under investigation interim notice - [ ] Incident template or linked doc includes a paste-ready template for: false alarm retraction - [ ] Incident template or linked doc includes a paste-ready template for: postmortem summary --- ### Labels `security`, `pre-launch` Cc: @PlasticDigits

totdking commented

2026-06-29 16:15:51 +00:00

(Migrated from gitlab.com)

mentioned in issue #381

PlasticDigits commented

2026-06-30 02:24:41 +00:00

(Migrated from gitlab.com)

mentioned in commit 5b299b1fbd

mentioned in commit 5b299b1fbde3df1c3cddea95ea9c9948cbd9e314

PlasticDigits commented

2026-06-30 02:25:06 +00:00

(Migrated from gitlab.com)

mentioned in merge request !970

Brouie commented

2026-06-30 02:59:07 +00:00

(Migrated from gitlab.com)

Verified #438 (issue-438-incident-comms-templates).

check_incident_comms_templates_docs.py -> OK
verify-issue-438.sh -> PASS 8 / FAIL 0

All five scenarios are present as paste-ready public + internal copy in the comms appendix with the shared placeholder table: pair paused, blacklist applied, exploit-under-investigation interim, false-alarm retraction, postmortem summary. The Communications section links the appendix, and the cross-links from blacklist-decision / emergency-commands / user-incident-faq / SECURITY.md all resolve.

Docs-only, no code. Verified on my side — @PlasticDigits good to merge !970 + close.

Verified #438 (issue-438-incident-comms-templates). - check_incident_comms_templates_docs.py -> OK - verify-issue-438.sh -> PASS 8 / FAIL 0 All five scenarios are present as paste-ready public + internal copy in the comms appendix with the shared placeholder table: pair paused, blacklist applied, exploit-under-investigation interim, false-alarm retraction, postmortem summary. The Communications section links the appendix, and the cross-links from blacklist-decision / emergency-commands / user-incident-faq / SECURITY.md all resolve. Docs-only, no code. Verified on my side — @PlasticDigits good to merge !970 + close.

PlasticDigits commented

2026-06-30 05:41:35 +00:00

(Migrated from gitlab.com)

mentioned in commit 69f9902458

mentioned in commit 69f990245821e0efd5d95826a85f02118db8d60f

PlasticDigits commented

2026-06-30 06:21:44 +00:00

(Migrated from gitlab.com)

mentioned in commit 20b6526de9

mentioned in commit 20b6526de972cc68ff9d48e756936c7f92ea5de6

PlasticDigits commented

2026-06-30 06:50:03 +00:00

(Migrated from gitlab.com)

Verification — #438 (SEC-G05)

Independent re-verification on main @ 20b6526d (merged issue-438-incident-comms-templates). No repo changes required.

Acceptance checklist

Item	Result	How verified
Paste-ready template: pair paused announcement	PASS	`docs/templates/incident-dex-indexer.md` §1 — public + internal copy with `[PAIR_ADDRESS]`, `[IMPACT_DESCRIPTION]`, `[TIMESTAMP_UTC]`, `[ESTIMATED_RESOLUTION]`, `[CONTACT_CHANNEL]`
Paste-ready template: blacklist applied notice	PASS	Same appendix §2 — wallet/token/pair via `[BLACKLIST_TARGET]`, `[REASON_IF_DISCLOSABLE]`
Paste-ready template: exploit under investigation (interim)	PASS	Same appendix §3 — interim public + internal wording
Paste-ready template: false alarm retraction	PASS	Same appendix §4 — links rollback checklist in `blacklist-decision.md`
Paste-ready template: postmortem summary	PASS	Same appendix §5 — structured public + internal summary with follow-ups

Automated checks

Command	Result
`python3 scripts/check_incident_comms_templates_docs.py`	PASS — all SEC-G05 markers + cross-links
`make verify-issue-438` / `bash scripts/qa/verify-issue-438.sh`	PASS 8 / FAIL 0

Manual / cross-link review

Check	Result
Communications section links appendix	PASS
`docs/runbooks/blacklist-decision.md` → comms appendix	PASS
`docs/runbooks/emergency-commands.md` → comms appendix	PASS
`docs/user-incident-faq.md` → comms appendix (background only, not per-incident copy)	PASS
`SECURITY.md` → appendix	PASS
`skills/AGENTS_INCIDENT_COMMS_TEMPLATES.md` present	PASS
`make check-incident-comms-templates-docs` in `lint` target	PASS

Overall: PASS — all five SEC-G05 scenarios are present as copy-paste templates with shared placeholder table; Communications section points operators to the appendix.

## Verification — #438 (SEC-G05) Independent re-verification on `main` @ `20b6526d` (merged `issue-438-incident-comms-templates`). No repo changes required. ### Acceptance checklist | Item | Result | How verified | |------|--------|--------------| | Paste-ready template: pair paused announcement | **PASS** | `docs/templates/incident-dex-indexer.md` §1 — public + internal copy with `[PAIR_ADDRESS]`, `[IMPACT_DESCRIPTION]`, `[TIMESTAMP_UTC]`, `[ESTIMATED_RESOLUTION]`, `[CONTACT_CHANNEL]` | | Paste-ready template: blacklist applied notice | **PASS** | Same appendix §2 — wallet/token/pair via `[BLACKLIST_TARGET]`, `[REASON_IF_DISCLOSABLE]` | | Paste-ready template: exploit under investigation (interim) | **PASS** | Same appendix §3 — interim public + internal wording | | Paste-ready template: false alarm retraction | **PASS** | Same appendix §4 — links rollback checklist in `blacklist-decision.md` | | Paste-ready template: postmortem summary | **PASS** | Same appendix §5 — structured public + internal summary with follow-ups | ### Automated checks | Command | Result | |---------|--------| | `python3 scripts/check_incident_comms_templates_docs.py` | **PASS** — all SEC-G05 markers + cross-links | | `make verify-issue-438` / `bash scripts/qa/verify-issue-438.sh` | **PASS** 8 / FAIL 0 | ### Manual / cross-link review | Check | Result | |-------|--------| | Communications section links appendix | **PASS** | | `docs/runbooks/blacklist-decision.md` → comms appendix | **PASS** | | `docs/runbooks/emergency-commands.md` → comms appendix | **PASS** | | `docs/user-incident-faq.md` → comms appendix (background only, not per-incident copy) | **PASS** | | `SECURITY.md` → appendix | **PASS** | | `skills/AGENTS_INCIDENT_COMMS_TEMPLATES.md` present | **PASS** | | `make check-incident-comms-templates-docs` in `lint` target | **PASS** | **Overall: PASS** — all five SEC-G05 scenarios are present as copy-paste templates with shared placeholder table; Communications section points operators to the appendix.

PlasticDigits (Migrated from gitlab.com) closed this issue

2026-06-30 06:50:04 +00:00