Incidents

Three commands on the server are made for incidents. Each asks before changing anything (--yes skips the question) and each is recorded in the audit log, with no one as the actor.

• revoke-access --everyone, or --user EMAIL, ends sessions and revokes access tokens; --sessions-only or --tokens-only does half. People sign in again and run rmk login; nobody is disabled and no password changes. --everyone also revokes the identity providers' SCIM tokens: generate new ones on each provider's page.
• rotate-secret writes a new AUTH_SECRET to the settings file and ends every session. Docker and rmk-server use it from their next request; a server run from a clone needs a restart. Access tokens aren't signed with it: revoke them too when they may have leaked. Two-factor secrets are encrypted with it, so it turns two-factor off for everyone who has it, and says how many: they set it up again. Identity providers' client secrets are re-encrypted, so they keep working.
• disable-sso turns every identity provider off, and its SCIM, and lets everyone sign in with a password again (Lockout and broken providers). Nobody is signed out.

What to do first, by what happened:

• A harmful version was released: yank it with a reason (Deprecate and yank), then find who approved and released it in the audit log. Projects that ask for latest move off it at their next rmk install; those that ask for a range keep installing it, with no warning, until they run rmk update: tell them.
• Someone lost their phone and their backup codes: a root resets their two-factor sign-in in Users, or on the server reset-two-factor --email EMAIL (any account, root's included). It ends their sessions; they sign in with their password and set it up again.
• An identity provider broke, or can't be trusted: run disable-sso; people with a password sign in with it, and root always can. If it may have signed in people who shouldn't be, also run revoke-access for them, or --everyone. If its SCIM may have been misused, Revoke its SCIM token on its page and look for user.created and member changes by it in the audit log. Then fix it (a new client secret: Replace), run Test sign-in, and turn it on again, then SCIM with a new token.
• Someone left: with SCIM, unassign or disable them at the provider: its next sync disables their account here (Entra syncs about every 40 minutes). To cut them off now, or without SCIM, disable them in Users: their sessions and tokens end at once.
• An access token leaked: its owner revokes it on the CLI & tokens page; otherwise revoke-access --user EMAIL --tokens-only.
• An account was taken over: disable it in Users (its sessions and tokens end at once), read its audit events, reset its password and enable it. For a root account, run reset-root-password on the server.
• The settings file, a backup or the server leaked: rotate-secret, then revoke-access --everyone --tokens-only, then change the database password and run the setup again with it.
• A moderator or admin acted against the rules: change their role on the workspace's page, then review what they approved and released.

Ronne sends no messages of its own: tell people through your own channels. The incident runbook has each incident step by step, how to check it worked, what to tell users, and a template.