This is really an awesome incident report! One of the good ones I've read.

Thank you Stack for making it public and Dean for a great write!

I am just curious to know few things: What is the size incident response team? Were there any specific protocols followed during the investigation? What key factor was involved to engage external security vendor? What were the points that were considers to choose that particular? What lessons were learnt from external security vendor? Was their audit process different (effective/ineffective) than what the team already were doing?

The article gives good glimpse of the entire architecture of Stack and the development processes. A more detailed read would or link if there is already an article about it would be great.

This is really an awesome incident report! One of the best ones I've read.

Thank you Stack for making it public and Dean for a great write!

I am just curious to know few things:

• What is the size of the incident response team?
• Were there any specific protocols followed during the investigation?
• What key factor was involved to engage external security vendor? What were the points that were considered in choosing that particular vendor?
• What lessons were learned from the external security vendor? Was their audit process different (effective/ineffective) from the one used already by the team?

The article gives good glimpse of the entire architecture of Stack and the development processes. A more detailed read would or link if there is already an article about it would be great.