When someone nukes

In the first minute

1. If you're the owner, use the buttons in Astri's DM: Contain strips whoever is behind it. Owner alerts has the details.
2. Otherwise, turn on under attack mode. It halves every admin's budget and makes anti-nuke act even if it was in shadow mode.
3. Remove Administrator from anyone you don't fully trust until it's over.

Repairing the damage

1. /rollback preview lists what the attacker changed. Read it, then /rollback run. Changes your staff made since are left alone.
2. If something is missing from the rollback, restore it from a backup.
3. Use /undo on anything Astri did to someone who turned out to be innocent.

Afterwards

• Run /permissions to see who still holds dangerous permissions, and /staff for what each staff member did this week.
• /incident export gives you a timeline to send to Discord if an account was stolen.
• Schedule backups if you hadn't, so the next one has a recent copy to go back to.