Inventory: access, environment and risks
Identify owners of the repository, hosting, database and external accounts. Record setup, deployment, backups, known incidents and missing documentation. Access or test data is shared only through an agreed safe channel.
Explore the scoped audit/rescue

