Overview
Collect the smallest evidence set that can distinguish transport, QuickNode infrastructure, endpoint policy, chain, and client failures. Never archive a full endpoint URL, API key, endpoint token, private key, or signed raw transaction.
Prerequisites
- Endpoint ID, chain, network, method, and bounded UTC window
- Incident owner and approved evidence destination
- Redaction rules for addresses, calldata, and business payloads
Instructions
Step 1: Freeze scope
State the first and last relevant timestamps, affected deployment, client version, endpoint ID, network, and request class. Exclude unrelated logs and broad home-directory collection.
Step 2: Gather local evidence
Use Read and Grep for sanitized configuration shape, application error chain, retry count, timeout, request ID, and dependency versions. Replace endpoint URLs with a stable redacted label.
Step 3: Gather provider evidence
Use Bash(qn:*) for authenticated, read-only endpoint status, metrics, and permitted error logs. Detailed Admin API logs are plan-gated; record “not available” instead of widening access.
Step 4: Preserve protocol layers
Record DNS/TLS outcome, HTTP status, JSON-RPC id, error code and message, chain error, latency, and response size separately. Include one nearby successful method when safe.
Step 5: Reproduce minimally
Use a documented read method, timeout, and non-production or read-only context. Do not reproduce transaction submission, a contract write, or a historical scan with uncontrolled range.
Step 6: Run a leak review
Use Grep on the proposed bundle for quiknode.pro, token-like paths, x-token, x-api-key, private-key markers, authorization headers, and raw signed transactions. Refuse delivery until findings are removed.
Tool Discipline
Use Read and Grep for bounded local evidence and Bash(qn:*) for read-only provider facts. This skill does not write archives, upload files, alter endpoints, or call transaction methods.
Output
- Scope and UTC incident window
- Redacted layered request/response evidence
- Metrics and provider-status comparison
- Minimal reproduction and leak-review receipt
Examples
A bundle includes endpoint ID, eth_getLogs, a ten-minute window, p95 latency, HTTP 200 with JSON-RPC error, and a sanitized request ID. It excludes the endpoint hostname path and log-filter contents.
Error Handling
| Failure | Response |
|---|---|
| Detailed logs unavailable | Use metrics and application evidence; state the plan boundary |
| Token found in bundle | Stop, revoke if exposed, redact, and rescan |
| Reproduction is destructive | Replace it with a read-only discriminating probe |
| Evidence is too broad | Narrow time, method, endpoint, and deployment |