This lesson's interactive features are locked, please to keep using them

Damage Control

When an incident is active, the first thing to do is limit the damage fast. You don't need a perfect explanation, you don't need to figure out who's to blame, and you don't need to opine about how this could have been avoided. Just stop the bleeding.

1. Contain the Damage

Reduce the attacker's access and stop further spread, for example:

Disable affected accounts
Revoke active sessions or tokens
Invalidate exposed credentials
Temporarily disable vulnerable endpoints/systems
Block obvious attack sources like IP ranges or abusive accounts

2. Preserve Evidence

After immediate containment, avoid cleanup that destroys forensic value. Before resetting, deleting, restoring, or rebuilding anything, be sure to preserve:

Logs and request traces
Timestamps and request or trace IDs
Current configuration snapshots
Known impacted resource lists

Without evidence, you won't know what happened or be able to establish the incident's scope for regulators, internal teams, or affected users.

3. Recover Safely

Restore anything you had to break during containment in a way that doesn't reintroduce the vulnerability. For example:

Patch the vulnerability before restoring access
Rotate credentials to invalidate any stolen secrets
Monitor closely for continued access or repeated exploitation once systems are back online

See the OWASP SCS Incident Response Handbook and NIST SP 800-61 Rev. 3 for detailed response guidance.

Assignment

Bearly Secure needs a kill switch that invalidates every active session during an incident.

Add emergency session revocation to src/auth/sessions.ts.

Create and export a function revokeAllActiveSessions(db: DatabaseSync): number helper.
In one database update, set revoked_at = CURRENT_TIMESTAMP for every active session without rewriting sessions that are already revoked.
Return the number of changed rows.
Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.