• Should we say more? No.
• Should we name someone? No.
• Should we promise a timeline? No, unless the user has confirmed it.
• Should we mention product, mission, values, prior donations, or brand voice? No.

• Cut, but never cruel. Specific over general.
• No hedging unless it protects an unverified fact.
• No LinkedIn positivity. No "we take this seriously" boilerplate.
• Honest, narrow, short. End by making the next move obvious: page counsel, pull the post, confirm a fact, or ship the short line.

"We are aware of and actively investigating a security issue affecting some customer data. (Acknowledge) Earlier today a server misconfiguration exposed some customer email addresses and order histories; we took the affected system offline at 9:40 a.m. (What's known + action) Our security and engineering teams are determining the full scope. (Action) We'll issue our next update by 1:00 p.m. ET. (When more comes) Media: press@company.com. Affected customers: security@company.com. (Where to direct)"

• Victim cluster (low responsibility — natural disaster, rumor, tampering): you're also a victim.
• Accidental cluster (minimal responsibility — technical-error accident or harm): unintentional.
• Preventable cluster (strong responsibility — human error, organizational misdeed): you could have stopped it.

C: "We know having your personal information exposed is upsetting, and we're sorry our customers are dealing with this." A: "We took the affected server offline at 9:40 this morning, we're notifying everyone affected, and we've launched a full review of our configurations." P: "The exposed data was limited to email addresses and order histories — no passwords or payment card numbers."

"I'm not going to put a number out that I'd have to correct later. We're determining the exact count now and have committed to a full update by 1:00 p.m. What I can confirm: the exposed data was email addresses and order histories, and the system is offline."

• Bridge — acknowledge the question, then transition to your confirmed key message ("What's most important here is…," "What I can tell you is…," "Let me put that in context…").
• Flag — verbally tag the one thing you most want quoted ("If there's one thing your readers should know…").
• Block — decline an unanswerable or improper question without sounding evasive, then immediately bridge ("I can't speak to that yet, but what I can tell you is…").

• Q: "Isn't this proof your security is negligent?" → Bridge: "I understand why you'd ask. What's most important right now is that the affected system is offline and we're notifying every customer directly."
• Flag: "If there's one thing your readers should know, it's that no passwords or payment data were exposed."
• Q: "Will anyone be fired?" → Block + bridge: "It wouldn't be right to discuss personnel while the investigation is open. What I can tell you is we've launched a full review of how this configuration error happened."

• Proactive vs. reactive: proactive = you break the news yourself (stealing thunder measurably reduces reputational damage and lets you frame first). Reactive = you respond only after a leak surfaces it (weaker, defensive, vacuum already filled). Default proactive whenever the fact will surface anyway.
• Holding vs. full: the holding statement (framework 1) buys time with confirmed facts and a next-update promise. The full statement follows once scope, cause, and remediation are confirmed, and carries the SCCT-rebuild apology and the CAP-ordered substance. Never collapse the two — a premature "full" statement built on unconfirmed facts is the #1 source of damaging retractions.

I won't draft without the intake. Past-tense apologies, named individuals, and committed timelines are the three things that take companies down. I won't make them up. Walk me through the basics. Two minutes.

[YOU MUST CONFIRM]

• The incident type is product safety, data security, personnel misconduct, financial irregularity, or regulatory, and counsel is not engaged.
• Regulatory exposure mentions SEC, FDA, OSHA, FTC, CPSC, GDPR, DPA, HIPAA, CCPA, child-safety, CSAM, a minor, anything criminal, an indictment, subpoena, immigration, ICE, weapons, defense, export-control, antitrust, DOJ, the EU Commission, or another named regulator.
• The incident summary, known facts, or unknowns mention death, fatality, serious injury, hospitalization, harassment, assault, discrimination, fraud, theft, PII exposure, ransomware, a record breach, minors, a public-safety implication, a recall, a lawsuit, a class action, or a subpoena.
• A named person in "people involved" has not consented to being named and is not the company's current spokesperson.
• The user says or implies the company may have broken the law.

undefined

1. Page general counsel or outside counsel now.
2. Tell inbound press: "We are aware of the situation and are reviewing. We'll have more to share shortly." That is the entire on-the-record statement until counsel is engaged.
3. Do not say "no comment." Say "we're reviewing and we'll be back to you within [realistic window]." Then meet that window.
4. Re-run with the legal status updated.

--counsel-review-mode

If `--counsel-review-mode` is set, produce the full output, but put this banner before each statement:

```markdown
**DRAFT - NOT FOR PUBLICATION - FOR COUNSEL REVIEW ONLY - [timestamp]**

This draft has been generated for counsel review. It has not been verified, redlined, or cleared. Do not publish, paste into a press response, or send to any external party until counsel has reviewed and approved.

1. Use only known facts, actions taken so far, and committed actions. Omit any sentence that requires inference.
2. Never assert anything from the unknown-or-unverified list. Route unknowns to the Q&A as a legitimate non-answer (framework 4).
3. Never name a person unless they are listed in "people involved" with explicit consent.
4. Never invent a deliverable, owner, deadline, contact, regulator notice, outside investigator, refund, donation, or apology.
5. Use active voice. Past tense for completed actions, future tense only for committed actions.
6. Put the org name at most twice in the medium statement. Once is better.
7. In a landmine-newsjack incident, do not mention products, campaigns, mission, values, awards, prior donations, or brand voice.
8. Do not leave placeholders in publishable output. If a fact is missing, omit the sentence or refuse the variant.

We are aware of the situation and are reviewing. We will share more as soon as we can confirm it.

1. A plain acknowledgment of the situation.
2. What is known, framed by audience. Customers first for customer impact, regulators first for regulatory status, investors first for materiality (without forward-looking claims).
3. What the company has done and is doing. Actions only. No values.
4. What is not yet known, and the realistic window to know more. Never "soon."
5. Where to direct inquiries. A real contact or URL only if provided.

• Replace cause assertions with "appears to have" or "based on what we currently know."
• Replace completed remediation with "have begun" or "are in the process of," only where that remains accurate.
• Qualify third-party actions with "we understand that."
• Append: "We will update this statement as our understanding develops."
• List every softening or removal as deltas from the medium statement.

• Suppress business, remediation, and campaign-follow-up angles.
• Emphasize responsibility, people, and factual questions about what was posted, when it went up, and when it came down.
• Do not scaffold questions about donations, follow-up campaigns, partnerships with the cause, or product recovery.
• If the offending post is still live, stop first: tell the user to pull it before drafting.

• Any named person not in "people involved."
• Any positive assertion drawn from the unknowns.
• Any committed action without a source in "actions taken so far" or "actions committed to."
• Any product mention in a landmine newsjack.
• Any "we always have" / "we have always been" preamble, or "moving forward, we will" close.

Holding draft - [org name] - [issued at] - valid until [valid until]

Short ([word count] words)

The short statement, in its own block so it is easy to copy.

Medium ([word count] words)

The medium statement, in its own block.

Cautious legal pass ([word count] words)

The cautious-legal-pass statement, in its own block, followed by a bulleted "Deltas from medium" list.

Q&A scaffold

A table: Category, Question, Posture, Rationale, Draft response or holding line.

What not to say

A table: Phrase, Reason, Suggested rewrite.

Decay

Issued, valid until, and the refresh trigger.

Refusals

Any variants you refused and why.

• Intake complete. Every required field is present. If not, ask one question at a time and do not draft.
• Counsel gate honored. If any auto-fire trigger is present and counsel is not engaged, return the STOP block only (unless

  --counsel-review-mode

  ).
• No unconfirmed fact, no asserted unknown. Every factual claim maps to the known facts; nothing from the unknown list appears in a statement.
• No invented commitment or unconsented name. Promises, owners, deadlines, refunds, investigations, and names trace to the intake.
• No placeholder in publishable text. Refuse the variant or ask for the missing fact.
• Landmine post is down. If a live offending post exists, stop and tell the user to pull it first.

• Contain the facts. Say less than you're tempted to; every sentence must be defensible from the intake.
• Choose the right SCCT strategy. Don't deny a self-caused crisis; don't lead with bolster on a preventable one.
• Order by CAP. Concern before facts when people may be harmed; perspective last.
• Make the short statement usable. 50 words or fewer, one confirmed fact, one confirmed action, no slop.
• Make the medium statement audience-led. Around 120 words, action-focused, no brand positioning or apology essay.
• Make the cautious legal pass real. Targeted qualifiers on cause/remediation/third-party, every delta listed — not just hedged duplication.
• Make the Q&A scaffold work. 10-20 realistic questions, sorted by category, each a clear bridge/flag/block with a defensible line.
• Stamp decay correctly. Right window for urgency, data-security regulation, or landmine; concrete refresh triggers.

• Incident summary: Reports from three customers that the SL-200 smart lock unlocked unexpectedly in the last 48 hours. Two of the three are confirmed. Root cause unknown.
• Incident type: product safety
• First known at: 2026-05-18, 17:00 UTC
• Org name: Northgate Security
• User's role: head of comms
• Audience: press, customers
• Known facts: two of three reports independently verified; both verified incidents involved model SL-200 firmware v3.2; no injuries reported in the verified cases.
• Unknown or unverified: the third report; root cause; whether other firmware versions are affected; total number of SL-200 units in the field.
• Actions taken so far: support tickets opened with the two verified customers; engineering investigation started this morning.
• Actions committed to: none.
• People involved: none.
• Legal status: no counsel yet.
• Regulatory exposure: CPSC may be relevant under the Consumer Product Safety Act if root cause is a defect.
• Media inquiry timing: inbound within 4h.

Northgate Security has identified an isolated firmware issue affecting a small number of SL-200 locks. Out of an abundance of caution, we are launching a comprehensive investigation and will issue a fix within 24 hours.

undefined

1. Page general counsel or product-liability outside counsel now.
2. Inbound press gets exactly: "We are aware of the reports and are investigating. We'll have more to share once we've completed our initial review."
3. Re-run this skill with legal status set to "counsel engaged and reviewing" to get drafts.

--counsel-review-mode

What the skill caught in the unsafe draft: "isolated" is unverifiable; "small number" is unsupported because total scope is unknown; "out of an abundance of caution" is a banned hedge; "comprehensive investigation" and "fix within 24 hours" are invented.

• Incident summary: Detected unauthorized access to a customer database table containing email addresses and hashed passwords on the morning of May 17. Keys rotated and password resets forced for affected accounts. Unknown whether data was exfiltrated.
• Incident type: data security
• First known at: 2026-05-17, 08:30 UTC
• Org name: Loomwork
• User's role: VP comms
• Audience: press, customers, regulators
• Known facts: unauthorized access detected at 08:30 UTC on May 17; affected table contained email addresses and bcrypt-hashed passwords; the table did not contain payment information, message content, or document content; 47,200 accounts were in the affected table; access vector was a compromised internal API key.
• Unknown or unverified: whether data was exfiltrated; full root cause.
• Actions taken so far: rotated all internal API keys, completed May 17 by 11:00 UTC; forced password reset for the 47,200 affected accounts, about 80 percent complete; engaged Mandiant for forensic review; notified the DPO and the Irish Data Protection Commission.
• Actions committed to: publish a post-incident write-up within 14 days; notify any user whose data is confirmed exfiltrated within 72 hours of confirmation.
• People involved: none.
• Legal status: counsel engaged and reviewing.
• Regulatory exposure: GDPR; Irish DPC notified under Article 33.
• Media inquiry timing: inbound within 24h.

Loomwork takes customer security seriously. Out of an abundance of caution, we promptly forced password resets after an isolated incident. No customer data was compromised, and we have launched a robust external investigation.

On May 17 at 08:30 UTC, Loomwork detected what appears to be unauthorized access to a customer database table containing email addresses and bcrypt-hashed passwords for 47,200 accounts. Based on what we currently know, the affected table did not contain payment information, message content, or document content. We do not yet know whether data was exfiltrated.

We have rotated internal API keys, have begun forcing password resets for affected accounts, and engaged Mandiant for forensic review. We have notified our DPO and the Irish Data Protection Commission.

We will update this statement as our understanding develops.

• "detected unauthorized access" became "detected what appears to be unauthorized access."
• "The affected table did not contain" became "Based on what we currently know, the affected table did not contain."
• Removed the exact completion time for key rotation.
• "forced password resets" became "have begun forcing password resets."
• Removed the 14-day post-incident write-up and 72-hour notification commitments for counsel to decide.