> For the complete documentation index, see [llms.txt](https://docs.podigee.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.podigee.com/documentation/grow-and-monetize/monetization/respond-to-a-credential-or-security-incident.md).

# Respond to a credential or security incident

Contain a credential or security incident, apply a tested remedy, and prove safe recovery.

Podigee Audio Video Ad Server gives an operator a controlled path from a detected security issue to a recorded recovery. After the first mention, this article uses Podigee Ad Server for the product name. It covers credential exposure, unauthorized access, unsafe integration behavior, and delivery impact. It does not replace the security specialist, legal, or provider response process.

Use this task when an integration, credential, delivery path, or protected record may be unsafe. Start with containment. Do not wait for a complete diagnosis before you limit further impact.

## Before you start

* You have permission to manage security incidents in the selected workspace.
* The incident has an owner or a named responder.
* You know the affected integration, delivery surface, or data scope.
* You know which provider or credential owner must rotate or suspend access.
* You have an approved containment profile or can ask the security owner to provide one.
* You know the evidence and notification obligations for the incident.

Never paste a credential, access token, or raw secret into a note, incident field, ticket, or report. Use the provider's secure credential controls and keep only a reference or digest in the case evidence.

## Find the incident and assess impact

1. Open **Monetization > Operations**.
2. Open the delivery issue or security incident with the highest listener, revenue, or data impact.
3. Check the current state, owner, affected scope, latest evidence, and response rule.
4. Confirm whether the incident is **Detected**, **Scoped**, or **Reopened**.

![The current One Podigee delivery issue shows high impact, no owner, a detected state, and the latest evidence time.](https://2032417310-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbqUKO6lljHGzkEAzliPI%2Fuploads%2Fgit-blob-f7b6f811b54f142e009fe8e87a79c69ff1cb765a%2Fdoc-monetization-067-issue-detected.png?alt=media)

*Read the impact and response rule before you take ownership.*

If the problem is a suspected credential leak, stop the affected integration or delivery path using the approved provider control. Do not test the credential in a production request.

## Contain the incident

1. Open **Monetization > Revenue jobs > Security, privacy, and audit**.
2. Select **Contain a security incident**.
3. Choose the active security incident.
4. Select the approved **Containment response**.
5. Set **Containment expires** to a future review boundary.
6. Add **Operator impact** when the response pauses delivery, removes a provider, or changes a customer workflow.
7. Select **Apply action**.

Containment changes the incident to **Contained**. The profile and expiry are recorded with the incident. Use a finite expiry so temporary containment cannot remain unnoticed.

## Rotate or suspend the affected credential

After containment, use the secure controls of the affected provider or integration:

1. Revoke the exposed credential or session.
2. Create a replacement credential with the smallest required permissions.
3. Store it in the approved secret store or integration form.
4. Test the connection in the permitted environment.
5. Record the provider receipt, rotation time, and credential reference in the incident.

Podigee Ad Server does not need the secret value. If the integration cannot be rotated safely, keep it suspended and ask the security or provider owner to decide the next action.

## Apply the approved remedy

1. Return to **Monetization > Revenue jobs > Security, privacy, and audit**.
2. Select **Apply an approved incident remedy**.
3. Choose the contained security incident.
4. Select the tested **Approved remedy** for that incident.
5. Review the incident evidence and remedy reference.
6. Select **Apply action**.

The remedy must belong to the same incident. The system checks the remedy digest and the incident evidence before it applies the change. A successful remedy moves the incident to **Monitoring**.

## Verify recovery and obligations

1. Wait for the replacement credential, connector, or delivery control to produce fresh evidence.
2. Open **Resolve a security incident**.
3. Select the incident in **Monitoring**.
4. Select recovery evidence that belongs to this incident.
5. Record the notification decision.
6. Set the remaining obligation to **Completed**, **Accepted by the responsible owner**, **Transferred to a named owner**, or **Formally waived**.
7. Add the post-incident review reference when one exists.
8. Select **Apply action**.

The system checks that recovery evidence belongs to the same incident, every notification decision is explicit, and every remaining obligation is closed or owned. It then moves the incident to **Resolved**.

![The current One Podigee issue stays in Monitoring recovery when clean podcast delivery is not yet confirmed.](https://2032417310-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbqUKO6lljHGzkEAzliPI%2Fuploads%2Fgit-blob-951f7ad6a7455ad00876c169f377857ed0fe259a%2Fdoc-monetization-067-recovery-pending.png?alt=media)

*A failed recovery check does not close the issue or hide the unresolved delivery state.*

## Restore normal delivery

Do not restore normal delivery only because a credential was rotated. Check the replacement connection, serving state, listener-safe fallback, and fresh audio or video delivery evidence. Restore the affected path through its approved delivery or integration workflow. Keep the incident in Monitoring until the evidence is complete.

## If recovery cannot be confirmed

* **The incident is still detected or scoped:** contain it and assign an owner before any remedy.
* **The containment expiry is close:** extend it only with a new review decision. Do not let it expire silently.
* **The remedy belongs to another incident:** stop and select the remedy that names this incident.
* **Recovery evidence is missing or from another incident:** keep the incident in Monitoring.
* **A provider cannot confirm rotation:** keep the affected path suspended and escalate to the provider or security owner.
* **An obligation remains open:** assign it to a named owner or record the formal decision. Do not resolve the incident with an empty obligation.

## Expected result

The affected path is contained, the credential or integration has a recorded secure response, the approved remedy preserves the original evidence, and recovery is proven before normal delivery returns. The incident has one clear owner, state, response profile, evidence trail, notification decision, and obligation result.

## Next useful tasks

Use [Manage an operational issue](/documentation/grow-and-monetize/monetization/manage-an-operational-issue.md) for delivery problems that do not involve a security incident. Use [Create an evidence package](/documentation/grow-and-monetize/monetization/create-an-evidence-package.md) to prepare a protected review package after the incident.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.podigee.com/documentation/grow-and-monetize/monetization/respond-to-a-credential-or-security-incident.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.