Security Runbooks — Lantern

This file contains short runbooks for common scenarios so on-call engineers can respond quickly.

1) Sudden spike in redemptions (possible fraud)

1. Triage: check recent deployments, review merchant campaign IDs, and inspect IP/geolocation patterns.
2. Temporary action: throttle redemptions globally or per-campaign; switch high-risk offers to QR-only redemption.
3. Identify affected users and merchant(s) and flag suspect redemptions as "under review".
4. If financial impact suspected, notify Legal and Billing teams.
5. For confirmed fraud, mark redemptions as invalid and create a dispute/resolution path for merchants.

2) Compromised admin account

1. Immediately revoke the compromised session and rotate admin credentials.
2. Force password reset + invalidate active tokens for the user.
3. Review logs for actions performed by the account (look for data exports or role changes).
4. Audit all admin accounts and require MFA reenrollment for admins.

3) Data exfiltration suspected

1. Contain network access and preserve forensic artifacts (logs, snapshots).
2. Engage Legal + Incident Lead; determine scope of data accessed.
3. If PII impacted, notify users and regulators per incident classification & legal guidance.

4) Vulnerability discovered in a dependency

1. Patch if possible and test; otherwise implement a temporary mitigation (e.g., firewall rule, feature flag).
2. Backport fixes to supported branches if applicable.
3. Communicate with stakeholders about timelines and risk.

---

Keep runbooks simple and actionable—reference this file from on-call notes and add run-specific commands and links to dashboards.