This is the public postmortem I guess haha. Ehhh don't stress dude you guys did the right thing! Unlike policy stuff, in an emergency it's right to move fast and break eggs. And then quickly course correct / clean things up as we get more info. I wasn't online at the time, and you did well as a nontechnical first responder.

So the overall result is on the shoulders of the whole team. No need to take that on yourself, we all share credit and blame. If this happened again I'd have zero issues if exactly the same thing played out.

Oh also @Zen shared some good ideas about a SOP for future situations like this (e.g. a list of measures we can "break glass" and run). This was the first time so we didn't have any weapons stockpiled. That's a process thing that our team can get better at. I'll see if I can find time to write this up into the admin team Notion, maybe this weekend.