1. Detection

Automated Detection

• 4-Layer Defense-in-Depth: Middleware → Dispatcher → Handler → Page Action validation failures trigger automatic audit logging
• Security Response Service: Pattern-based threat detection for XSS, SQLi, command injection, path traversal
• Rate Limiter: Brute-force detection with automatic IP blocking after threshold
• Account Lockout: 5 failed attempts → 15-minute lock (HTTP 423)

Manual Detection Channels

Channel	Response SLA
security@sveltycms.com	48 hours
GitHub Security Advisory	24 hours
security.txt	RFC 9116 standard

---

2. Severity Classification

Level	Definition	Response Time	Example
🔴 Critical	Unauthenticated RCE, data exfiltration, auth bypass	4 hours	SSRF to internal metadata
🟠 High	Authenticated privilege escalation, stored XSS	24 hours	SVG polyglot upload
🟡 Medium	Information disclosure, DoS vector	72 hours	GraphQL introspection
🟢 Low	Best practice violation, hardening opportunity	Next release	Missing rate limit

---

3. Response Procedure

Step 1: Contain (Immediate)

1. Deploy hotfix or configuration change to block the vector
2. Rotate any potentially exposed secrets (JWT, encryption keys, API tokens)
3. If applicable, trigger IP blocking for active exploit attempts

Step 2: Investigate (Within SLA)

1. Review crypto-chained audit logs for the affected time window
2. Run verifyChain() to confirm no log tampering
3. Identify all affected tenants, users, and data
4. Document the attack vector and entry point

Step 3: Fix (Within SLA)

1. Implement the permanent fix in next branch
2. Add regression test to prevent recurrence
3. Update security documentation
4. Run full CI parity pipeline (format && lint && check && test:unit)

Step 4: Disclose

1. Publish GitHub Security Advisory
2. If applicable, request CVE via GitHub’s CNA
3. Update SECURITY.md with acknowledgment
4. Notify affected enterprise customers directly

---

4. Post-Incident

• Root Cause Analysis: Document in docs/architecture/security/tested-security-features.mdx
• Test Coverage: Add tests for the specific attack vector
• Process Review: Update this runbook if the response procedure was insufficient
• Metrics Update: Update security scorecard in SECURITY.md

---

5. Communication Templates

Critical Incident Notification

Subject: [CRITICAL] Security Incident — SveltyCMS

A critical security vulnerability has been identified and patched.

- Affected versions: [range]
- Fixed in: [version]
- Impact: [description]
- Action required: Upgrade to [version] immediately

Full advisory: [link]

---

6. References

• Security Scorecard
• Security.txt
• GitHub Security Advisories
• EU Directive 2006/114/EC Compliance
• OWASP Incident Response

---

Related

• Security Overview
• API Security & Token Hardening
• Architecture Overview