Security incident response

Who

Verilo is run by one person, the founder (hello@verilo.app), who handles every step below. There is no second responder.

What counts as an incident

• High: customer or merchant data was, or may have been, read, copied, changed or deleted by someone who should not have it.
• Medium: a secret or token was exposed, with no sign yet that it was used.
• Low: a reported weakness with no exposure.

Treat anything uncertain as the higher level until it is ruled out.

How an incident is noticed

• A report to hello@verilo.app from a merchant, a customer or a security researcher.
• A security notice from Fly.io, Neon, Cloudflare, Shopify, Gorgias or Zendesk.
• Something unexpected in the app's logs or the audit log: sign-ins, exports or deletions nobody asked for, or a burst of failed requests.
• Fly's health checks failing, or Shopify, Gorgias or Zendesk refusing Verilo's tokens.

Verilo has no automatic alerting yet. The founder reads the logs and the audit log, and these notices, as they arrive.

What to do, in order

1. Contain (at once). Rotate every exposed secret with fly secrets set; revoke the exposed tokens in Shopify, Gorgias, Zendesk, Neon or Cloudflare; turn off the affected feature, or stop the app (fly scale count 0) if data is still leaking.
2. Keep evidence. Save the Fly logs and the audit log for the period before they roll over. Note what happened and when.
3. Assess. Work out which stores, which customers and which data were affected, and whether it is an eligible data breach under Australia's Notifiable Data Breaches scheme.
4. Notify. Don't wait for the full picture before telling Shopify or merchants: send what is known and follow up.

Who is told, and how fast

• Shopify: within 24 hours of becoming aware of an actual or suspected breach of merchant data (API Terms 6.2.10), at security@shopify.com and through Shopify Partner support.
• Affected merchants: within 72 hours, by email, with what is known (Data Processing Agreement, section 8).
• Gorgias or Zendesk: when their credentials or data are involved.
• The Office of the Australian Information Commissioner, and affected people: as soon as practicable once an eligible data breach is confirmed; the assessment is finished within 30 days.

Afterwards

1. Fix and learn. Fix the cause, not only the symptom. Record the incident, its cause and the fix in the incident log (docs/policies/incident-log.md). Update this policy and the data loss prevention policy if they were wrong.

After hours

The founder checks email at least daily. Reports to hello@verilo.app with "Security" in the subject are read first.

Verilo (ABN 15 979 331 090) · hello@verilo.app