Emergency Risk Steps

If you suspect exposure, focus on immediate containment and documentation. Do not improvise large changes all at once.

First actions (first hour)

1. Stop active sharing from affected accounts/devices.
2. Preserve key logs/messages/screenshots for timeline reconstruction.
3. Move to a trusted channel and notify only necessary people.

Stabilization actions

• Rotate credentials on known-safe devices.
• Review recent recipients and revoke stale links.
• Write a factual timeline while memory is fresh.

What this does not protect

• Risks already created before containment.
• Offline copies held by other parties.
• Legal or employment consequences without professional counsel.

Next safe steps

• Read /security/non-technical/whistleblower-quickstart.
• Read /faq/legal-and-risk/what-if-im-under-immediate-risk.