The incident isn't over when the dust settles. The half-day after is when you turn this experience into permanent improvement.
The three questions
- What did the attacker actually access? (audit log, session table archive, app-level activity log)
- What would have happened if I'd done nothing? (which credentials/data would have been exposed)
- What should change so this is harder/less harmful next time? (the actual hardening)
What to capture while the memory is fresh
| Artifact | Why | How |
|---|---|---|
Snapshot of security_sessions at incident time | Forensic record of what was active | cp security.db security.db.incident-2026-04-15 |
| App access log for the suspect window | What URLs were hit, when | uvicorn / nginx access logs |
| Tailscale device log | When the device was active in the mesh | Tailscale admin → Logs |
| Find My location history | Where the device was during the window | iCloud / Google account |
| Your own timeline | "I noticed missing at 14:32, clicked revoke at 14:34..." | Notes app while it's fresh |
The hardening backlog
For each thing that could have been worse, file a small change:
- "PIN was 4 digits and shoulder-surfable" → 5 or 6 digits.
- "I noticed too late because no email alert" → add a webhook on Tailscale device-connect from new IPs.
- "Killswitch took 90 seconds to find" → bookmark folder + browser-extension shortcut.
- "Tailscale key was 180 days" → drop to 30 days; accept the re-auth friction.
- "Couldn't reach admin from my tablet" → install Tailscale on tablet; test the path.