What is logged
The audit log captures four types of actions:| Action | Description |
|---|---|
| CREATE | A new resource was created (e.g. project, environment, secret, member, …) |
| UPDATE | An existing resource was modified |
| DELETE | A resource was removed |
| VIEW | A sensitive read occurred (e.g. viewing secret values) |
What each entry contains
Every audit log entry records:- Actor — the user ID and username who performed the action
- Action — CREATE, UPDATE, DELETE, or VIEW
- Entity — the resource type and ID that was affected
- Data before — the state of the resource before the action (for updates and deletes)
- Data after — the state of the resource after the action (for creates and updates)
- Scope — the context of the action (e.g. which environment or project)
- Timestamp — when the action occurred
Tamper evidence
Each log entry carries a SHA-256 hash computed from its own content and the hash of the previous entry, forming a hash chain. This means:- Modifying any entry changes its hash, which breaks the chain at that point
- Deleting an entry creates a gap in the chain
- Inserting a fake entry breaks the hash link between surrounding entries