Safe Online Exam
Roll out & operate

Incident response

What to do for a bad release, a secret or certificate compromise, and host loss — without weakening the security controls under pressure.

The recurring theme: under incident pressure, do not make an unreviewed change to the security posture. The controls are what make the tool trustworthy for assessment.

A bad release

Stop promotion. Preserve logs and database state.
Decide whether the failure is application-only or schema/data-affecting.
Route traffic to a previous revision or image only when its schema contract is compatible (see Rollback).
Otherwise, ship a reviewed forward correction, or restore into a controlled target.

Never run automatic down-migrations during a failed deploy.

A secret or certificate compromise

Pause the affected assessments.
Rotate only the affected material and deploy pinned new versions.
Distribute any replacement managed-client identity to devices.
Invalidate affected settings through the normal workflow.
Require fresh .seb downloads.

Do not do any of these

Do not enable production debug mode, widen URL filters, or place client private identities in the server runtime. If the SEB private identity is suspected compromised, follow the certificate incident path in Certificate management: rotate and reissue. Do not switch an encrypted deployment to plaintext compatibility mode as an incident shortcut; that is a separate, documented risk decision.

Host loss (Docker / VPS)

Restore encrypted backups onto a clean host.
Recreate protected environment/secret files from the secret vault.
Apply migrations with the intended image.
Verify /ready before changing DNS or shifting traffic.

After recovery, resume monitoring of disk space, certificate expiry, container health, backup age, cleanup age, PostgreSQL connections, and host security updates.

What to keep on hand

  • The current runbook for rotation and the exact secret names for your environment.
  • Off-host, access-controlled backups with a verified restore drill on record.
  • The verification sequence to confirm the integration after recovery.
  • Contact paths for your Canvas administrator and device-management owner, since a full recovery may touch all three systems.

Operations

Day-2 operation of a released installation: cleanup, backups, restore drills, verified upgrades, schema-aware rollback, monitoring, and secret rotation.

Troubleshooting

A symptom index — find what you are seeing, jump to the check that resolves it. Organized by where the symptom appears.

On this page

A bad releaseA secret or certificate compromiseHost loss (Docker / VPS)What to keep on hand