Before
Teams likely had to open the secret incident, look up the affected repository and commit details, identify the author or other responders, and copy the context into a team message. They then had to collect a remediation decision, assign or share the incident, notify the chosen people, and manually record the actions taken.
How it works
- Receive and validate the incident event, then retrieve the secret finding and enrich it with repository, commit, file, author, and incident details.
- Post an interactive Slack thread and route the selected response to automatic incident assignment, team-lead sharing, engineering-user selection, or credential-rotation follow-up.
- Update the original thread with the resulting actions and timestamps so the handoff and current status remain documented.
Workflow details
- Trigger and validation: The workflow starts when a webhook reports an incident-triggered event. It retrieves the secret incident and proceeds only when the incoming event contains the expected incident action.
- Incident enrichment: It gathers the detected secret type, affected file, commit reference, author information, incident date, source details, organization repositories, and related commit data so the team receives meaningful context instead of a bare alert.
- Interactive response: A Slack message presents remediation choices, including assigning the incident to the commit author, assigning it to one or more other engineering users, sharing the incident with a team lead, or starting a secret-rotation process.
- Assignment and escalation: Based on the selected action, the workflow assigns the incident, looks up selected users, shares the incident URL with the team lead, or asks a chosen employee to perform the credential rotation and report completion to the team lead. These selections remain human-approved, while the subsequent lookups, notifications, and incident assignments are automated.
- Status documentation: The workflow builds action-specific updates and appends them to the original Slack conversation with timestamps, creating a consolidated record of who was notified, who was assigned, and which follow-up action was initiated.
What changed
Incident context and remediation choices are now presented in one interactive Slack thread, with GitGuardian assignments, user lookups, team-lead sharing, notifications, and status updates executed automatically after a human selects the response. The assigned employee still performs the actual credential rotation or other remediation work.
Work removed
Manually retrieving incident, repository, commit, file, and author details; composing and sending stakeholder notifications; looking up selected users; assigning or sharing the incident; notifying a rotation assignee; and recording action timestamps in the incident conversation.
Expected outcome
Conservatively, the workflow can remove at least three recurring manual handoffs per qualifying incident—context lookup, stakeholder notification, and assignment or status updates—while preserving human control over the remediation choice and credential rotation.
