Incident playbook

Horizon outage or slowness

Symptoms: users see "The Stellar network is unreachable", trades pile up in Locking escrow, Releasing XLM or Refunding seller, logs show Horizon request failed.

1. Check Stellar status and your Horizon provider.
2. Don't manually change trade statuses — reconciliation settles them once Horizon responds.
3. Post a notice to users that trades may take longer.
4. If the outage is prolonged, switch HORIZON_URL to another provider on the same network and restart.
5. Afterwards, filter Trades by the transitional statuses and confirm the list drains.

Payment windows expiring during an outage

Auto-refunds also need Horizon, so they queue up and run when it's back. Buyers who paid but couldn't mark paid should contact support with their trade ID and receipt.

Suspected fraud ring

1. Search Users for shared payout account numbers or similar names.
2. Review their trades' chats and receipts.
3. Suspend accounts — active orders are cancelled automatically; in-progress trades continue.
4. Record evidence before banning.

Platform key exposure

Treat as critical.

1. Put the platform in maintenance (stop the API) to prevent new escrows.
2. Generate a new platform key.
3. For each open escrow, settle trades while the old key still controls them.
4. Deploy the new PLATFORM_SECRET_KEY and restart.
5. Review Stellar history of all escrow accounts for unexpected operations.

Email delivery failures

Registration still succeeds; users can use Resend email. Check SMTP credentials and provider dashboards. Verification links can also be generated by updating emailVerifyTokenHash in the database in an emergency.