Security Incident Register¶
Purpose. The single record of information security incidents at Soon: what happened, how it was assessed, what was done, and what changed afterwards. It is the record SOC 2 CC7.3 asks for ("security incidents are evaluated") and the input to the quarterly review of incidents in the Incident Response Procedure. A quarter with no incidents gets a dated nil entry, signed by the ISM — an empty table is indistinguishable from a register nobody keeps.
How to use. Any event reported through #security or security@soon.works that the
Information Security Manager assesses as an incident (not just an event) gets a row
within one working day. Personal-data breaches additionally follow the
Breach Notification Procedure.
Findings from scanners, pentests and audits are not incidents; they go to the
deficiency log in Linear.
Register¶
| ID | Detected | Reported by | Summary | Severity | Personal data? | Actions taken | Closed | Root cause / lesson | Linear |
|---|---|---|---|---|---|---|---|---|---|
| — | — | — | No incidents recorded since the ISMS was established on 2026-07-02. See the Q3 2026 nil entry below. | — | — | — | — | — | — |
| INC-2025-01 (pre-ISMS, recorded retrospectively 2026-09-29) | 2025-03 (abusive teams created 2025-02-27 and 2025-03-01) | AWS: SES bounce rate, then sending suspended | POST25 — platform abused to send phishing. An attacker created two teams named POST25, put phishing text with a link in the team owner's name field ("DERNIER AVIS ! La livraison n'a pas pu être effectuée…" / "¡ÚLTIMO AVISO!…") and invited ~92,000 addresses, so Soon's invitation emails carried the phishing message. 90,000+ emails were sent; the bounce rate rose and AWS suspended SES |
P2 (assigned retrospectively; ISM to confirm) | Not assessed at the time. No customer tenant data is known to have been accessed; the harm was Soon's email infrastructure carrying phishing to third parties | Mailosaur (whose inboxes were used) informed; name validation (no URLs, length limits); disposable and blacklisted domains rejected (Sentinel and the Blackmail table, 50K+ domains); 500-member cap per team; SES suppression list enabled; SES reinstated after the fixes |
2025-03-21 | User-supplied names are content that reaches third parties through our emails. Validate them where they are entered and treat every outbound channel as an injection surface. Re-confirmed by the Sept 2026 pentest (#3, S-610). Controls verified still present in soon-server main on 2026-09-29 |
soon-server #996, #1001 · post-incident notes: Google Doc Scam abuse prevention — email issue |
Quarterly nil entries¶
| Quarter | Statement | Signed | Date |
|---|---|---|---|
| Q3 2026 (Jul–Sep, to date) | No information security incidents were detected or reported between 2026-07-02 and 2026-09-08. Sources checked: #security, security@soon.works, GuardDuty findings, Sentry, provider notifications. To be re-confirmed at quarter end (2026-09-30). | Olaf Jacobson (ISM) | 2026-09-08 |
Severity scale¶
| Level | Meaning | Examples |
|---|---|---|
| S1 Critical | Confirmed loss, exposure or corruption of customer data, or production unavailable > 4 h | Database exposed, ransomware, credential compromise with access to customer data |
| S2 High | Contained compromise or a near miss with customer-data exposure possible | Leaked API key rotated before use, phishing that captured a founder password |
| S3 Medium | Security control failed with no evidence of data impact | Public S3 bucket found empty, MFA disabled on a critical system |
| S4 Low | Policy breach or event with no security impact | Laptop left unlocked, unapproved SaaS signup |