FormsFort
EN ES

Incident Response

How FormsFort handles incidents.

FormsFort uses automated alerting, request tracing, audit logging, and dead-letter review to detect and respond to incidents. This page describes the detection capabilities, response process, and escalation signals.

Detection capabilities

Automated alert evaluation

The alert worker evaluates queue backlog, delivery failures, HTTP non-2xx volume, submission blocks, rate-limit buckets, blocked attachment scans, upload storage errors, and pending upload reservations against configurable thresholds.

External incident webhooks

Alerts can be routed to external incident management systems via HTTPS webhooks. Separate channels are supported for warning, critical, and escalation severities.

Migration failure alerts

When a database migration fails during deployment, a critical migration_failure alert is sent to configured incident webhooks.

Audit logging

All sensitive admin mutations are recorded in the audit log with actor type, request ID, action, target, and redacted metadata.

Request tracing

Every API response includes X-Request-Id, X-Trace-Id, and W3C traceparent headers for correlation across services and log aggregation.

Dead-letter review

Failed email, webhook, and Google Sheets jobs are surfaced through the dead-letter endpoint for operator review without exposing retained retry payloads.

Incident response process

1

Detection

Automated alerts fire when thresholds are breached. Operators monitor queue backlogs, delivery failure rates, HTTP error rates, and abuse signals.

  • Alert worker evaluates configured thresholds
  • External webhook receives alert payload
  • Operator reviews /v1/admin/alerts and /v1/admin/dead-letters
2

Triage

The on-call operator assesses scope, affected forms, and root cause using request IDs, audit logs, and delivery records.

  • Identify affected forms and workspaces using request IDs
  • Check delivery status and error classes
  • Review audit log for recent configuration changes
  • Determine if the incident is security-related or operational
3

Containment

Immediate actions to limit impact, such as blocking abusive IPs, suppressing unsafe recipients, or disabling compromised integrations.

  • Add abuse rules for malicious IPs, domains, or user agents
  • Suppress bounced or compromised recipient emails
  • Rotate compromised access keys, API tokens, or webhook URLs
  • Disable affected integrations from the dashboard
4

Remediation

Fix the root cause, restore service, and verify the fix.

  • Deploy the fix through the standard release gate process
  • Verify health endpoints return 200
  • Run launch evidence drill if infrastructure changed
  • Clear suppression entries or abuse rules if added temporarily
5

Post-incident

Document the incident, update runbooks, and implement preventive measures.

  • Record timeline, root cause, and affected scope
  • Update alert thresholds if the incident was detected late
  • Add or update abuse rules for new attack patterns
  • Notify affected customers if data was impacted

Escalation signals

These conditions indicate that immediate operator attention is required:

  • /health endpoint returns non-200
  • Queue backlog grows for more than one worker interval
  • Delivery failure rates spike above normal baseline
  • rate_limited, abuse_ip, abuse_domain, attachment_scan_failed, or captcha failures spike
  • Upload cleanup stops expiring stale reservations
  • Database backup or restore drill fails
  • Critical alert fires to the escalation webhook

Customer notification

If a security incident affects customer data, FormsFort will notify affected users as soon as reasonably possible after the incident is contained. Notification will include the nature of the incident, the data affected, and the remediation steps taken.

For security-related inquiries or to report a suspected incident, contact [email protected].

Contact security Security overview