13Playbooks
Procedures, not
principles.
Each playbook fits in a sitting and assumes no security background. Steps are ordered by what closes access fastest, not by what is most interesting.
0115 minutes · do this first
17 minStop the bleed
When a platform you use confirms a breach, the first hour is about closing access, not understanding it. Rotate the keys that can spend money or publish code.
0210 minutes · the invisible one
15 minFix certificate trust
A compromised root can survive in non-browser trust stores long after browsers block it. Update every store your code actually uses.
0320 minutes · highest leverage
17 minBrowser hygiene
Your browser is the session layer for everything. Move passwords out of it, update it, and remove extensions you cannot justify.
0415 minutes · money
15 minBank safety after a breach
A bank breach is followed by phishing that quotes the breach. Change credentials inside the official app and verify every inbound call.
0545 minutes · CI and packages
45 minSupply-chain sweep
Most developer compromises arrive through a dependency, a workflow, or an update channel. Audit the three places secrets are exposed.
0630 minutes · if you terminate traffic
30 minWeb server emergency
PHP2Shell, NGINX, and HTTP/3 all land on the same surface. Patch, cap, and remove what you do not need.
0720 minutes · phone and laptop
20 minDevice update pass
The phone is the second factor and the laptop is the session store. Update both before you audit anything else.
0825 minutes · multiply the effect
25 minFamily plan
The people around you are the softest target. A code word and a callback rule are more effective than a lecture.
How to use these
Pick by trigger, not by title
The first line of each playbook says when it applies. If the trigger has not happened, the playbook is not urgent.
Do the top step within the hour
Every procedure is ordered by access closure. If you only do one step, do the first one.
Write down the time
A short timestamped note turns a panicked afternoon into a report you can hand to anyone.