Our first real security incident and what our runbook got wrong

CybersecurityDevOpsIncident ResponseSecurity

A leaked API key led to unexpected usage charges before we caught it. Our incident runbook assumed we'd notice from monitoring alerts — we actually noticed from a billing anomaly two days later. Rewrote the runbook to include billing alerts as a first-class detection signal, not just an afterthought.