Publishing & Disclosure

Inventory where the shared credential lives and what else it grants, order the cutover by consumer impact, migrate each package to a publisher bound to one repository and workflow, and treat deleting the shared token as the completion criterion.

Withdrawal is itself an outage: removing a version breaks every build, rebuild and rollback that references it across the estate. Prefer flagging plus a fixed replacement, and reserve hard removal for artifacts whose availability is the hazard.

Become a CNA when your advisory volume justifies a permanently staffed function; it buys control of timing and record content. Below that, requesting identifiers through a root is cheaper and avoids commitments you would fail to meet.

Extending trades five vendors' users staying exposed longer against one vendor's users being exposed at publication. Decide against a rule agreed at the start: one short extension for a genuine engineering constraint, otherwise publish on the date.

Start from a support policy written before the incident, then narrow by evidence: whether the flaw exists and is reachable in each line, whether a safe patch is possible, and whether that line's users can deploy it in time.

Publish and staff a vulnerability disclosure policy first. A bounty multiplies inbound reports without creating anyone to triage or fix them; the binding constraint is response and remediation capacity, not researcher supply.

Only when the old identity cannot be reclaimed. Changing identity forces every consumer to update a pin by hand, you cannot verify that they did, and slow ones stall for months. If the account is recovered and the attacker's path closed, keep the identity and rotate underneath it.