Security: incident communications templates for SEC-G05 (#438) #970

Merged
PlasticDigits merged 4 commits from issue-438-incident-comms-templates into main 2026-06-30 06:21:43 +00:00
PlasticDigits commented 2026-06-30 02:25:04 +00:00 (Migrated from gitlab.com)

Summary

Implements GitLab #438 (SEC-G05): adds five paste-ready communications templates to the incident tracker for pair pause, blacklist applied, exploit-under-investigation interim notice, false-alarm retraction, and postmortem summary. Each template includes fill-in placeholders for address, impact, timestamp, resolution/actions, and contact channel.

Also adds a drift guard (make check-incident-comms-templates-docs), make verify-issue-438, agent playbook skills/AGENTS_INCIDENT_COMMS_TEMPLATES.md, and cross-links from emergency/blacklist runbooks, user FAQ, SECURITY.md, and docs README.

Acceptance checklist

Criterion Verification Result
Paste-ready template: pair paused announcement grep '### 1. Pair paused' docs/templates/incident-dex-indexer.md PASS
Paste-ready template: blacklist applied notice grep '### 2. Blacklist applied' docs/templates/incident-dex-indexer.md PASS
Paste-ready template: exploit under investigation interim notice grep '### 3. Exploit under investigation' docs/templates/incident-dex-indexer.md PASS
Paste-ready template: false alarm retraction grep '### 4. False alarm retraction' docs/templates/incident-dex-indexer.md PASS
Paste-ready template: postmortem summary grep '### 5. Postmortem summary' docs/templates/incident-dex-indexer.md PASS
Doc drift guard make check-incident-comms-templates-docs PASS
Issue verification script make verify-issue-438 PASS

Third-party verification

git fetch origin issue-438-incident-comms-templates
git checkout issue-438-incident-comms-templates
make verify-issue-438

Manual spot-check: open docs/templates/incident-dex-indexer.md → Appendix: Communications templates (SEC-G05) and confirm each of the five sections has Public + Internal copy blocks with bracketed placeholders.

  • Issue #438 (leave open until merge)
  • SEC-G05 security checklist item
## Summary Implements GitLab #438 (SEC-G05): adds five **paste-ready communications templates** to the incident tracker for pair pause, blacklist applied, exploit-under-investigation interim notice, false-alarm retraction, and postmortem summary. Each template includes fill-in placeholders for address, impact, timestamp, resolution/actions, and contact channel. Also adds a drift guard (`make check-incident-comms-templates-docs`), `make verify-issue-438`, agent playbook `skills/AGENTS_INCIDENT_COMMS_TEMPLATES.md`, and cross-links from emergency/blacklist runbooks, user FAQ, SECURITY.md, and docs README. ## Acceptance checklist | Criterion | Verification | Result | |-----------|--------------|--------| | Paste-ready template: pair paused announcement | `grep '### 1. Pair paused' docs/templates/incident-dex-indexer.md` | PASS | | Paste-ready template: blacklist applied notice | `grep '### 2. Blacklist applied' docs/templates/incident-dex-indexer.md` | PASS | | Paste-ready template: exploit under investigation interim notice | `grep '### 3. Exploit under investigation' docs/templates/incident-dex-indexer.md` | PASS | | Paste-ready template: false alarm retraction | `grep '### 4. False alarm retraction' docs/templates/incident-dex-indexer.md` | PASS | | Paste-ready template: postmortem summary | `grep '### 5. Postmortem summary' docs/templates/incident-dex-indexer.md` | PASS | | Doc drift guard | `make check-incident-comms-templates-docs` | PASS | | Issue verification script | `make verify-issue-438` | PASS | ## Third-party verification ```bash git fetch origin issue-438-incident-comms-templates git checkout issue-438-incident-comms-templates make verify-issue-438 ``` Manual spot-check: open `docs/templates/incident-dex-indexer.md` → **Appendix: Communications templates (SEC-G05)** and confirm each of the five sections has Public + Internal copy blocks with bracketed placeholders. ## Related - Issue #438 (leave open until merge) - SEC-G05 security checklist item
PlasticDigits commented 2026-06-30 02:27:09 +00:00 (Migrated from gitlab.com)

Security review — MR !970

Commit reviewed: 5b299b1fbde3df1c3cddea95ea9c9948cbd9e314
Scope: SEC-G05 incident communications templates (#438) — markdown templates, runbook cross-links, drift guard (scripts/check_incident_comms_templates_docs.py), QA script (scripts/qa/verify-issue-438.sh), Makefile targets, agent playbook.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Method

  • Inspected all 12 changed files (docs-only + static doc-drift scripts).
  • Traced attacker-controlled input paths: none — no runtime services, contracts, indexer routes, or frontend code modified.
  • Checked drift/verify scripts for injection, path traversal, secret handling, and unsafe subprocess use: fixed repo-relative paths only, no external input, no network I/O.
  • Reviewed template content for accidental secret patterns, exploit-recipe disclosure, or unsafe URL schemes: placeholders only; public templates include “do not share exploit details” guidance; links are static GitLab blob anchors to existing FAQ sections.

Prior threads

No prior security-review notes on this MR; nothing to re-report.

Inline findings

None — no block:security label applied.

## Security review — MR !970 **Commit reviewed:** `5b299b1fbde3df1c3cddea95ea9c9948cbd9e314` **Scope:** SEC-G05 incident communications templates (#438) — markdown templates, runbook cross-links, drift guard (`scripts/check_incident_comms_templates_docs.py`), QA script (`scripts/qa/verify-issue-438.sh`), Makefile targets, agent playbook. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Method - Inspected all 12 changed files (docs-only + static doc-drift scripts). - Traced attacker-controlled input paths: none — no runtime services, contracts, indexer routes, or frontend code modified. - Checked drift/verify scripts for injection, path traversal, secret handling, and unsafe subprocess use: fixed repo-relative paths only, no external input, no network I/O. - Reviewed template content for accidental secret patterns, exploit-recipe disclosure, or unsafe URL schemes: placeholders only; public templates include “do not share exploit details” guidance; links are static GitLab blob anchors to existing FAQ sections. ### Prior threads No prior security-review notes on this MR; nothing to re-report. ### Inline findings None — no `block:security` label applied.
Brouie commented 2026-06-30 02:59:07 +00:00 (Migrated from gitlab.com)

mentioned in issue #438

mentioned in issue #438
PlasticDigits commented 2026-06-30 05:08:32 +00:00 (Migrated from gitlab.com)

added 12 commits

  • 5b299b1f...1921c81f - 11 commits from branch main
  • fd681aaa - Merge origin/main into issue-438-incident-comms-templates

Compare with previous version

added 12 commits <ul><li>5b299b1f...1921c81f - 11 commits from branch <code>main</code></li><li>fd681aaa - Merge origin/main into issue-438-incident-comms-templates</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/252/diffs?diff_id=1877400758&start_sha=5b299b1fbde3df1c3cddea95ea9c9948cbd9e314)
PlasticDigits commented 2026-06-30 05:08:35 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with origin/main (merged fd681aaa).

Conflicts resolved (5 files):

  • Makefile — kept both check-incident-comms-templates-docs (SEC-G05) and check-incident-template-docs (SEC-G06); merged lint deps and .PHONY with main's check-launch-monitoring-docs and verify-issue-{416,439,440} targets.
  • docs/README.md — combined incident template entry (timeline + communications templates + both agent playbooks).
  • docs/runbooks/blacklist-decision.md — timeline anchor links from main + SEC-G05 communications appendix from this branch.
  • skills/AGENTS_BLACKLIST_DECISION.md / skills/AGENTS_EMERGENCY_COMMANDS.md — merged incident template references (timeline + comms templates).

Sanity checks: make verify-issue-438, make verify-issue-439, and related doc drift guards all pass.

Resolved merge conflicts with `origin/main` (merged `fd681aaa`). **Conflicts resolved (5 files):** - `Makefile` — kept both `check-incident-comms-templates-docs` (SEC-G05) and `check-incident-template-docs` (SEC-G06); merged `lint` deps and `.PHONY` with main's `check-launch-monitoring-docs` and `verify-issue-{416,439,440}` targets. - `docs/README.md` — combined incident template entry (timeline + communications templates + both agent playbooks). - `docs/runbooks/blacklist-decision.md` — timeline anchor links from main + SEC-G05 communications appendix from this branch. - `skills/AGENTS_BLACKLIST_DECISION.md` / `skills/AGENTS_EMERGENCY_COMMANDS.md` — merged incident template references (timeline + comms templates). **Sanity checks:** `make verify-issue-438`, `make verify-issue-439`, and related doc drift guards all pass.
PlasticDigits commented 2026-06-30 05:09:51 +00:00 (Migrated from gitlab.com)

Security review — MR !970 (re-review)

Commit reviewed: fd681aaa99efe3afa7f91910066aa671473c0c08
Scope: SEC-G05 incident communications templates (#438) — 12 files: markdown templates/runbook cross-links, drift guard (scripts/check_incident_comms_templates_docs.py), QA script (scripts/qa/verify-issue-438.sh), Makefile targets, agent playbook. Includes post-merge conflict resolution with origin/main (Makefile lint/.PHONY, docs README, runbook anchors).

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Method

  • Re-reviewed full MR diff (base_sha 1921c81f → head_sha fd681aaa) after merge; prior review covered pre-merge tip 5b299b1f.
  • Traced attacker-controlled input to sinks: none — no runtime services, CosmWasm contracts, indexer routes, or frontend code modified.
  • Inspected drift/verify scripts: fixed repo-relative paths only, no CLI/env/external input, no subprocess with interpolated paths, no network I/O.
  • Reviewed template content for secret leakage, exploit-recipe disclosure, unsafe URL schemes, and injection surfaces: bracketed placeholders only; public templates include “do not share exploit details” / “no exploit recipe” guidance; links are static GitLab blob anchors to existing FAQ sections.
  • Ran make check-incident-comms-templates-docs and make verify-issue-438 — PASS.

Prior threads

Prior top-level security review on 5b299b1f reported zero medium+ findings; merge commit changes are conflict-resolution cross-links only — no new attack surface identified.

Inline findings

None — no block:security label applied.

## Security review — MR !970 (re-review) **Commit reviewed:** `fd681aaa99efe3afa7f91910066aa671473c0c08` **Scope:** SEC-G05 incident communications templates (#438) — 12 files: markdown templates/runbook cross-links, drift guard (`scripts/check_incident_comms_templates_docs.py`), QA script (`scripts/qa/verify-issue-438.sh`), Makefile targets, agent playbook. Includes post-merge conflict resolution with `origin/main` (Makefile `lint`/`.PHONY`, docs README, runbook anchors). **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Method - Re-reviewed full MR diff (`base_sha` `1921c81f` → `head_sha` `fd681aaa`) after merge; prior review covered pre-merge tip `5b299b1f`. - Traced attacker-controlled input to sinks: **none** — no runtime services, CosmWasm contracts, indexer routes, or frontend code modified. - Inspected drift/verify scripts: fixed repo-relative paths only, no CLI/env/external input, no subprocess with interpolated paths, no network I/O. - Reviewed template content for secret leakage, exploit-recipe disclosure, unsafe URL schemes, and injection surfaces: bracketed placeholders only; public templates include “do not share exploit details” / “no exploit recipe” guidance; links are static GitLab blob anchors to existing FAQ sections. - Ran `make check-incident-comms-templates-docs` and `make verify-issue-438` — PASS. ### Prior threads Prior top-level security review on `5b299b1f` reported zero medium+ findings; merge commit changes are conflict-resolution cross-links only — no new attack surface identified. ### Inline findings None — no `block:security` label applied.
PlasticDigits commented 2026-06-30 05:41:36 +00:00 (Migrated from gitlab.com)

added 4 commits

  • fd681aaa...ba73247a - 3 commits from branch main
  • 69f99024 - Merge origin/main into issue-438-incident-comms-templates

Compare with previous version

added 4 commits <ul><li>fd681aaa...ba73247a - 3 commits from branch <code>main</code></li><li>69f99024 - Merge origin/main into issue-438-incident-comms-templates</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/252/diffs?diff_id=1877429764&start_sha=fd681aaa99efe3afa7f91910066aa671473c0c08)
PlasticDigits commented 2026-06-30 05:41:50 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main (issue #435 / SEC-G02 anomaly signals landed after the prior merge).

Makefile: kept both sides — check-anomaly-signals-docs + check-incident-comms-templates-docs, verify-issue-435 + verify-issue-438, and both targets in .PHONY / lint / help.

Sanity: make verify-issue-438 passes locally.

Resolved merge conflicts with `main` (issue #435 / SEC-G02 anomaly signals landed after the prior merge). **Makefile:** kept both sides — `check-anomaly-signals-docs` + `check-incident-comms-templates-docs`, `verify-issue-435` + `verify-issue-438`, and both targets in `.PHONY` / `lint` / `help`. Sanity: `make verify-issue-438` passes locally.
PlasticDigits commented 2026-06-30 05:43:18 +00:00 (Migrated from gitlab.com)

Security review — MR !970

Commit reviewed: 69f990245821e0efd5d95826a85f02118db8d60f
Scope: SEC-G05 incident communications templates (#438) — 12 files: markdown templates/runbook cross-links, drift guard (scripts/check_incident_comms_templates_docs.py), QA script (scripts/qa/verify-issue-438.sh), Makefile targets, agent playbook.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Method

  • Re-reviewed full MR diff (base_sha ba73247a → head_sha 69f99024); prior reviews on 5b299b1f and fd681aaa also reported zero medium+.
  • Traced attacker-controlled input to sinks: none — no runtime services, CosmWasm contracts, indexer routes, or frontend code modified.
  • Inspected drift/verify scripts: fixed repo-relative paths only, no CLI/env/external input, no subprocess with interpolated paths, no network I/O.
  • Reviewed template content for secret leakage, exploit-recipe disclosure, unsafe URL schemes, and injection surfaces: bracketed placeholders only; public templates include “do not share exploit details” / “no exploit recipe” guidance; links are static GitLab blob anchors to existing FAQ sections.
  • Ran make check-incident-comms-templates-docs and make verify-issue-438 — PASS.

Prior threads

Prior top-level security reviews on 5b299b1f and fd681aaa reported zero medium+ findings; current tip is a further merge/rebase with no new attack surface identified.

Inline findings

None — no block:security label applied.

## Security review — MR !970 **Commit reviewed:** `69f990245821e0efd5d95826a85f02118db8d60f` **Scope:** SEC-G05 incident communications templates (#438) — 12 files: markdown templates/runbook cross-links, drift guard (`scripts/check_incident_comms_templates_docs.py`), QA script (`scripts/qa/verify-issue-438.sh`), Makefile targets, agent playbook. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Method - Re-reviewed full MR diff (`base_sha` `ba73247a` → `head_sha` `69f99024`); prior reviews on `5b299b1f` and `fd681aaa` also reported zero medium+. - Traced attacker-controlled input to sinks: **none** — no runtime services, CosmWasm contracts, indexer routes, or frontend code modified. - Inspected drift/verify scripts: fixed repo-relative paths only, no CLI/env/external input, no subprocess with interpolated paths, no network I/O. - Reviewed template content for secret leakage, exploit-recipe disclosure, unsafe URL schemes, and injection surfaces: bracketed placeholders only; public templates include “do not share exploit details” / “no exploit recipe” guidance; links are static GitLab blob anchors to existing FAQ sections. - Ran `make check-incident-comms-templates-docs` and `make verify-issue-438` — PASS. ### Prior threads Prior top-level security reviews on `5b299b1f` and `fd681aaa` reported zero medium+ findings; current tip is a further merge/rebase with no new attack surface identified. ### Inline findings None — no `block:security` label applied.
PlasticDigits commented 2026-06-30 06:17:16 +00:00 (Migrated from gitlab.com)

added 10 commits

  • 69f99024...2f966c04 - 9 commits from branch main
  • 234de8ee - Merge origin/main into issue-438-incident-comms-templates

Compare with previous version

added 10 commits <ul><li>69f99024...2f966c04 - 9 commits from branch <code>main</code></li><li>234de8ee - Merge origin/main into issue-438-incident-comms-templates</li></ul> [Compare with previous version](/PlasticDigits/cl8y-dex-terraclassic/-/merge_requests/252/diffs?diff_id=1877470565&start_sha=69f990245821e0efd5d95826a85f02118db8d60f)
PlasticDigits commented 2026-06-30 06:17:20 +00:00 (Migrated from gitlab.com)

Resolved merge conflicts with main (merged origin/main into issue-438-incident-comms-templates).

Conflicts resolved:

  • Makefile — kept both SEC-G05 (check-incident-comms-templates-docs, verify-issue-438) and main additions (check-suspicious-activity-queries-docs, check-pool-triage-docs, verify-issue-437, verify-issue-436).
  • docs/README.md — listed suspicious-activity runbook (#437) and incident comms templates (SEC-G05) cross-links.
  • docs/runbooks/emergency-commands.md — combined pool-triage workflow (#436) with communications-templates appendix pointer (SEC-G05).

Sanity: make verify-issue-438 passes locally.

Resolved merge conflicts with `main` (merged `origin/main` into `issue-438-incident-comms-templates`). **Conflicts resolved:** - `Makefile` — kept both SEC-G05 (`check-incident-comms-templates-docs`, `verify-issue-438`) and main additions (`check-suspicious-activity-queries-docs`, `check-pool-triage-docs`, `verify-issue-437`, `verify-issue-436`). - `docs/README.md` — listed suspicious-activity runbook (#437) and incident comms templates (SEC-G05) cross-links. - `docs/runbooks/emergency-commands.md` — combined pool-triage workflow (#436) with communications-templates appendix pointer (SEC-G05). Sanity: `make verify-issue-438` passes locally.
PlasticDigits commented 2026-06-30 06:19:37 +00:00 (Migrated from gitlab.com)

Security review — MR !970 (re-review)

Commit reviewed: 234de8ee6a67225f121c4c8ff76b1a3d8102a58b
Scope: SEC-G05 incident communications templates (#438) — 12 files: markdown templates/runbook cross-links, drift guard (scripts/check_incident_comms_templates_docs.py), QA script (scripts/qa/verify-issue-438.sh), Makefile targets, agent playbook. Tip includes merge of origin/main (2f966c04); MR diff unchanged in attack surface vs prior reviews.

Outcome: FINDINGS: 0 medium+

Security review: no medium+ findings on this diff.

Method

  • Re-reviewed full MR diff (base_sha 2f966c04 → head_sha 234de8ee); prior reviews on 5b299b1f, fd681aaa, and 69f99024 also reported zero medium+.
  • Traced attacker-controlled input to sinks: none — no runtime services, CosmWasm contracts, indexer routes, or frontend code modified.
  • Inspected drift/verify scripts: fixed repo-relative paths only, no CLI/env/external input, no subprocess with interpolated paths, no network I/O.
  • Reviewed template content for secret leakage, exploit-recipe disclosure, unsafe URL schemes, and injection surfaces: bracketed placeholders only; public templates include “do not share exploit details” / “no exploit recipe” guidance; links are static GitLab blob anchors to existing FAQ sections.
  • Ran make check-incident-comms-templates-docs and make verify-issue-438 — PASS.

Prior threads

Prior top-level security reviews on 5b299b1f, fd681aaa, and 69f99024 reported zero medium+ findings; current tip is a further merge/rebase with no new attack surface identified.

Inline findings

None — no block:security label applied.

## Security review — MR !970 (re-review) **Commit reviewed:** `234de8ee6a67225f121c4c8ff76b1a3d8102a58b` **Scope:** SEC-G05 incident communications templates (#438) — 12 files: markdown templates/runbook cross-links, drift guard (`scripts/check_incident_comms_templates_docs.py`), QA script (`scripts/qa/verify-issue-438.sh`), Makefile targets, agent playbook. Tip includes merge of `origin/main` (`2f966c04`); MR diff unchanged in attack surface vs prior reviews. **Outcome:** `FINDINGS: 0` medium+ Security review: **no medium+ findings** on this diff. ### Method - Re-reviewed full MR diff (`base_sha` `2f966c04` → `head_sha` `234de8ee`); prior reviews on `5b299b1f`, `fd681aaa`, and `69f99024` also reported zero medium+. - Traced attacker-controlled input to sinks: **none** — no runtime services, CosmWasm contracts, indexer routes, or frontend code modified. - Inspected drift/verify scripts: fixed repo-relative paths only, no CLI/env/external input, no subprocess with interpolated paths, no network I/O. - Reviewed template content for secret leakage, exploit-recipe disclosure, unsafe URL schemes, and injection surfaces: bracketed placeholders only; public templates include “do not share exploit details” / “no exploit recipe” guidance; links are static GitLab blob anchors to existing FAQ sections. - Ran `make check-incident-comms-templates-docs` and `make verify-issue-438` — PASS. ### Prior threads Prior top-level security reviews on `5b299b1f`, `fd681aaa`, and `69f99024` reported zero medium+ findings; current tip is a further merge/rebase with no new attack surface identified. ### Inline findings None — no `block:security` label applied.
PlasticDigits commented 2026-06-30 06:21:44 +00:00 (Migrated from gitlab.com)

mentioned in commit 20b6526de9

mentioned in commit 20b6526de972cc68ff9d48e756936c7f92ea5de6
PlasticDigits (Migrated from gitlab.com) merged commit 20b6526de9 into main 2026-06-30 06:21:44 +00:00
Sign in to join this conversation.
No reviewers
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
code/cl8y-dex-terraclassic!970
No description provided.