[Title] — Postmortem
_Date of incident: YYYY-MM-DD HH:MM UTC. Author: __. Status: draft / final.TL;DR
One paragraph. What happened, who was affected, how long, what we did.Timeline (UTC)
- HH:MM — event
- HH:MM — event
Impact
- Customers affected:
- Revenue impact:
- Data impact:
- Reputation impact:
Root cause
Use 5-whys. Be honest. Don’t blame people.What went right
- What did the system catch?
- What did our processes do well?
- What was faster than expected?
What went wrong
- What did the system miss?
- What was slower than expected?
- What did we discover during the incident?
Lucky factors
What saved us that we shouldn’t rely on next time?Action items
Lessons for the runbooks
- INCIDENT.md update:
- DEPLOY_ROLLBACK.md update:
- SECRET_RECOVERY.md update: