Playbook

blastradius / docs / Incident playbooks

Incident playbooks

One page per role. Each page gives the incident as that person meets it, three to six commands, and what the output means and does not mean.

Overview

Every example runs against the sample org that ships inside br:

shell
$ br demo            # the 6-step tour
$ br demo hunt --advisory GHSA-q7vr-4xhc-m2jw

The story: on 2026-05-12 at 07:10 UTC, three @tanstack packages published the day before turn out to be malicious. The sample org (acme) has 40 repos, two CI runners, two laptops and a container registry. The demo clock is pinned, so the output does not change from one day to the next. On your own org, drop demo: br hunt --advisory .... The quoted output in these pages is checked against the real binary in CI.

RolePageThe question
On-call AppSec engineerappsec-oncall.mdAre we hit, where, and what do I paste in #security?
Platform / DevOpsplatform-eng.mdWhich caches, artifacts, runners and images do I clean, in what order?
Team leadteam-lead.mdWhat do I change in my repos, and how do I know I am done?
CISOciso.mdWhat is the number for the CEO, and how sure are we?
Auditor / customer assuranceauditor.mdWhat can I send a customer that holds up?
IR consultantir-consultant.mdWhat do I hand counsel, and what is outside my reach?
SOC analystsoc-analyst.mdWhere does this package or file live?
Startup CTOstartup-cto.mdYes or no in five minutes, with no security team?
AppSec or CISO, with no advisoryclaimcheck.mdWhich of our own package names could a stranger already own? (try br demo claimcheck: a sample registry, no network)

Also in CI and in an agent: the GitHub Action, --format sarif and the pre-commit hook (docs/action.md), and br mcp (docs/mcp.md).

Part 1

Three things that hold on every page #

  • A clean answer names what it did not check. CLEAR WITH GAPS is not CLEAR. --strict turns the gaps into exit 3.
  • br reads. It never changes anything. fix, purge and notify print what to do, and a person runs it.
  • The index has an age. Every answer starts with how old the index is and which sources are stale. Refresh with br scan --stale before you rely on a number.

Part 2

What the demo cannot show #

  • --now and --live need a network, so br demo refuses them. They re-read GitHub or a machine before answering.
  • br demo claimcheck runs on a small sample of manifests and a sample registry snapshot built into the binary, not on the demo org's own 40 repos, and every line that depends on the sample says "sample registry". It cannot --record (the demo keeps nothing). claimcheck.md shows it.
  • br init, br scan and br import build or change an index. The demo has a fixed one.
  • br fix in the demo says it "could not check" whether bumping a package also moves its dependency, because it cannot reach the npm registry. On a real org it checks.
  • Changes you make in a demo run (a note, a --progress baseline) are thrown away when the command ends.

Next

Edit this page on GitHub