KAI-VORAL-INC-001 — Incident Record
Template ID: TPL-09-04 | Stage: 09-Operate-and-Maintain | Version: 0.3
Status: Project record created from the controlled template.
Purpose: Record an incident from detection to closure: impact, timeline, actions, communications and follow-ups.
Required inputs: Alert or report; logs; runbook.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-INC-001 |
| Template used |
TPL-09-04 Incident Record v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-28 / 2026-10-28 / Pending |
| Applicable SOP and revision |
SOP-LC-09 v0.3 |
| Related issue, commit, requirement and evidence links |
OPEN-007; OPEN-008; KAI-VORAL-IRS-001; docs/lifecycle/_evidence/scan-a6b4429.md |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), on-device models (mobile/assets/models/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call.
Related approved requirements, risks and change records: None approved. Related drafts are listed in document control.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. No operations records (monitoring, incidents, complaints, backups) existed before this documentation. Operations found in the code are labelled Observed; everything else is a proposal for its owner. This records a security finding treated as a possible incident; the files' contents were not opened.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Incident ID and timeline
| Time (UTC) |
Event |
| 2025-11-13 |
dentalapp/mongoDb_usernamePassword added to Git (commit d55e801) |
| 2025-12-06 |
The file name added to .gitignore (commit 70b00b5) — the file stays tracked |
| 2026-01-01 |
dentalapp/google-credentials.json added to Git (commit 5130774) |
| Not recorded |
Database backups added under dentalapp/backups/ (OPEN-008) |
| 2026-10-27 |
Found during the repository scan for this documentation and reported to the developer |
2. Affected customers data and safety
| Item |
Entry |
| Data |
Possible patient and doctor personal data in the backup files; database and cloud credentials |
| People affected |
Not known — depends on the backup contents and who had repository access |
| Safety |
No direct patient-safety effect |
3. Detection symptoms severity and containment
| Item |
Entry |
| Detection |
Repository scan (sdlc.py scan) |
| Severity |
Proposed (Claude Code, for confirmation): Sev 1 (possible personal data exposure) |
| Containment |
Not done yet: rotate the credentials, limit repository access, remove the files and purge history (WP-01) |
4. Actions owners and communications
| Time |
Action / communication |
By |
| 2026-10-27 |
Finding reported to the developer; recorded as OPEN-007 and OPEN-008 |
Claude Code |
| Pending |
Breach assessment under the India DPDP Act 2023 (notice to the Data Protection Board and affected people if needed) |
Security & Privacy Officer |
5. Evidence logs and recovery
| Evidence |
Location |
| File paths and commits |
docs/lifecycle/_evidence/scan-a6b4429.md; Git history |
| Repository access list |
GitHub organisation settings — not collected |
6. Closure and postincident actions
| Item |
Entry |
| Status |
Open |
| Post-incident actions |
RCA KAI-VORAL-RCA-001; WP-01; secret scanning in CI (OPEN-039) |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Tracker project ID, named requester and sponsor, and named reviewers are not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Tracker entry; names with roles |
Open |
| OPEN-007 |
Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Credentials rotated; files removed and purged from history; confirmation |
Open |
| OPEN-008 |
Database backups with personal data committed to Git: 9 files under dentalapp/backups/ (commit 92a4b77; contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Files purged from history; breach/incident assessment recorded |
Open |
| OPEN-039 |
No CI pipeline builds, lints, tests or scans the code; the only workflow is the ML keep-awake job |
Tech Lead |
2026-11-30 (proposed) |
Yes |
CI workflow running build, lint, tests, audit and secret scan on every PR |
Open |
| OPEN-047 |
No incident, complaint or medical-device vigilance (reportability) process and no incident or complaint log |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Approved process and a log in use |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-28 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Security & Privacy Officer (name to be assigned) |
Pending |
Pending |
Pending |