A formal written account a DeFAI project publishes after a security incident, fund loss, or system anomaly, typically covering the incident timeline, root cause analysis, scope of impact, and follow-up remediation and prevention measures — a key document for assessing a team's post-incident response capability and transparency.

A set of common abnormal characteristics identified by comparing multiple past DeFAI security incidents that typically existed, in some form, before an incident formally broke out (an unrevoked temporary permission, risk-control investment visibly lagging behind strategy complexity, a team's communication suddenly becoming less transparent) — used to help users recognize similar high-risk signals earlier, before the next incident happens.

The process by which, after a security incident, an independent security researcher (a white-hat hacker) or the attacker themselves helps facilitate or negotiate the return of some or all of the affected assets to the victim project — typically involving public outreach, bounty negotiation, or racing to move remaining vulnerable assets to a safe address using the same exploit before a malicious actor can.