EventSmith incident response policy
Last updated November 4, 2026.
This policy says what Lareys does when something threatens the security of EventSmith or the data it holds for stores. To report a security problem, write to hello@lareys.dev.
What counts as an incident
- Someone reads, changes or deletes a store's data without permission.
- A secret, an access token or one of our keys is exposed.
- A hook can reach another store's data, or something the app's limits should block.
- A store's data is lost.
- An account that can reach EventSmith's systems is used by someone else.
Who handles it
The person at Lareys who runs EventSmith leads every incident from start to finish: they decide its severity, take each step below, keep the record and send every notice.
Severity
| Level | Meaning | Start within |
|---|---|---|
| Critical | A store's or its customers' data was accessed, exposed or lost, or a key or token was exposed. | 1 hour |
| High | A weakness that could expose data but hasn't, or EventSmith is down for every store. | 4 hours |
| Medium | One store is affected and no data is exposed. | 1 business day |
| Low | A security improvement with no current risk. | Next release |
Steps
- Record it. Open an incident record with the time it was found, how it was found, and the severity. Every later step is added to it with its time.
- Contain it. Stop the harm first: rotate exposed keys and secrets, revoke tokens, turn off the affected hooks, and take EventSmith offline if that is the only way to stop it.
- Keep the evidence. Export Cloudflare's account audit log and EventSmith's logs for the time of the incident and keep them with the record. The audit log holds every dashboard and API action on the account for 18 months.
- Find the cause and the reach. Work out what happened, which stores and which data were affected, and when it started and stopped.
- Tell the people affected. When a store's or its customers' data was affected, email each affected store without undue delay and within 72 hours of confirming it: what happened, what data, what we have done and what they should do. Tell Shopify as our Partner agreement requires, and help stores with any notice they must give their customers or a regulator.
- Recover. Ship the fix through a normal release, and restore lost hooks or settings from the database's backups, which can return it to any minute in the last 30 days.
- Learn from it. Within two weeks, write down what happened, why, and what changes so it doesn't happen again, and make those changes.
Records
Incident records and their evidence are kept for at least 18 months.
Review
This policy is reviewed once a year and after every Critical or High incident.