Damage Control

Reduce the attacker's access and stop further spread, for example:

• Disable affected accounts
• Revoke active sessions or tokens
• Invalidate exposed credentials
• Temporarily disable vulnerable endpoints/systems
• Block obvious attack sources like IP ranges or abusive accounts

After immediate containment, avoid cleanup that destroys forensic value. Before resetting, deleting, restoring, or rebuilding anything, be sure to preserve:

• Logs and request traces
• Timestamps and request or trace IDs
• Current configuration snapshots
• Known impacted resource lists

Without evidence, you won't know what happened or be able to establish the incident's scope for regulators, internal teams, or affected users.

Restore anything you had to break during containment in a way that doesn't reintroduce the vulnerability. For example:

• Patch the vulnerability before restoring access
• Rotate credentials to invalidate any stolen secrets
• Monitor closely for continued access or repeated exploitation once systems are back online

See the OWASP SCS Incident Response Handbook and NIST SP 800-61 Rev. 3 for detailed response guidance.

Bearly Secure needs a kill switch that invalidates every active session during an incident.

Add emergency session revocation to the account store.

1. Add a func (store *Store) RevokeAllActiveSessions(ctx context.Context) (int, error) method to internal/accounts/store.go.
2. Call the pre-generated store.queries.RevokeAllActiveSessions query once. It uses SQLite's current UTC timestamp and leaves sessions that are already revoked unchanged.
3. Return its changed-row count as an int. Wrap any database error with useful context.
4. Start the app.

With Bearly Secure still running, run and submit the CLI tests from the project root.