Skip to main content
Evolving. This area is visible in the product, but it is still evolving and should not be treated like a fully mature surface yet.

​
Goal

Respond to a hosted workload security incident without losing the evidence needed for review or recovery.

​
Prerequisites

  • A project with a workload security incident

​
Workflow

1
Open the project Security tab and inspect the sanitized incident summary.
2
Confirm which environment and deployment were quarantined.
3
Correct the source, image, dependency declaration, or network request that caused the incident.
4
Submit the incident for operator review.
5
Redeploy only after release, a fresh scan, a fresh admission receipt, and valid grants.

​
What quarantine does

  • Installs deny-all egress for the affected workload.
  • Removes public routing and stops the task.
  • Disables deploys, automatic deploys, terminals, and one-off execution for the affected project.
  • Preserves immutable images, manifests, application logs, deployment logs, and flow evidence.
  • Creates a durable incident and audit event.

​
Notifications

After quarantine is committed, StackShift creates an in-app notification and queues a mandatory account-security email for the project owner and relevant team administrators. Email failure never delays or rolls back isolation. Notices include the project, environment, time, reason category, actions taken, incident link, review path, and support contact. They exclude source excerpts, credentials, environment values, destination histories, and sensitive detection signatures.

​
Release requirements

  • An operator must approve release.
  • The image and workload configuration must pass a new scan.
  • The deployment must receive a fresh admission receipt.
  • Every required external destination must have a current approved grant.
  • StackShift sends a separate resolution notice describing whether configuration changes or redeployment are still required.

​
Inspect incidents from the CLI

​
Expected result

The unsafe execution remains isolated while logs and deployment evidence stay available for a controlled review and release.

​
Common failures

  • Trying to redeploy, open a terminal, or run a one-off while the project is quarantined.
  • Reusing the image or receipt involved in the incident instead of producing fresh admission evidence.
  • Requesting release before the required external dependency grants are approved.

Hosted egress and admission

Understand the image admission receipt and restricted outbound network policy applied to hosted customer workloads.

External databases and private routes

Declare exact external services, request scoped egress, and connect private-only databases without opening general network access.

Alerts view

Use alerts to focus on active operational problems instead of scanning every resource manually.