incident-response
Installation
SKILL.md
Incident Response
Overview
When production breaks, follow a structured process. Don't panic, don't guess, don't push hot fixes without understanding.
Core principle: Restore service first, investigate root cause second, prevent recurrence third.
Severity Classification
| Severity | Definition | Response Time | Examples |
|---|---|---|---|
| SEV1 | Service down, all users affected | Immediate | Database crashed, API 500s on all routes, auth broken |
| SEV2 | Major feature broken, many users affected | < 30 min | Payment processing fails, search returns no results |
| SEV3 | Minor feature broken, some users affected | < 2 hours | Export fails for large datasets, specific edge case error |
| SEV4 | Cosmetic or minor, workaround exists | Next business day | UI alignment issue, non-critical notification delay |