# Incident Response Plan

# Principles:

  • Transparency: All incidents and fixes are documented here for the community.
  • Stewardship: Take responsibility for protecting users and the project.
  • Protection: Act to minimize harm and provide guidance.

# How Two.js Handles Incidents

# 1. Detection & Triage

  • We monitor security reports sent via security outreach, GitHub advisories, issues, and npm notifications.
  • If we spot a bug or report that looks like a security risk, we treat it as an incident.

# 2. Assessment

  • Check the severity:
    • Critical: npm package or repo compromised, malicious code, supply chain attack.
    • High: Vulnerabilities that allow code execution, XSS, or leak secrets.
    • Medium: Denial of service, memory leaks, or integrity issues.
    • Low: Docs defacement, minor regressions.

# 3. Response

  • Acknowledge the report (privately if sensitive, publicly if not).
  • For critical/high issues:
    • Rotate any exposed secrets/tokens.
    • Patch the bug or vulnerability.
    • Deprecate or yank affected npm versions if needed.
    • Rebuild and redeploy docs/site from a clean commit.
  • For medium/low issues:
    • Patch and document the fix.

# 4. Communication

  • Update this wiki page with a summary of the incident and the fix.
  • For major issues, we post a GitHub Release note and a pinned Issue.
  • Provide upgrade or mitigation steps for users.

# 5. Recovery & Hardening

  • After fixing, review what happened and update this process if needed.
  • Add tests or automation to prevent similar issues.
  • Rotate credentials and check repo/npm security settings.

# Recent Incidents & Fixes


  • None at this time

If you spot a security issue, please report it via security outreach. We’ll respond as quickly as possible.