Add Audit Logs Automatically

The problem

Manual audit logging is error-prone and often leads to security vulnerabilities like leaking PII or credentials in logs. Developers struggle to maintain a consistent, append-only history of sensitive actions across fragmented services and frameworks.

What it does

• Detects your project stack, authentication patterns, and database schema to ensure architectural consistency.
• Creates centralized, append-only audit services and models for tracking actors, targets, and timestamps.
• Automatically redacts sensitive data such as passwords, tokens, and PII from log payloads.
• Injects audit hooks into security-sensitive workflows like auth events, role changes, and data deletions.
• Generates migrations and unit tests to verify that logs are created and protected from unauthorized modification.

Why this beats prompting it yourself

This skill enforces a strict security protocol that prevents common DIY mistakes, such as trusting client-side actor IDs or logging raw request bodies. It ensures structured, searchable metadata across your entire application instead of inconsistent string-based logs.

Use cases

• Implementing SOC2 or GDPR compliant activity trails for administrative actions.
• Adding "who changed what" history to critical database records.
• Tracking failed login attempts and security-sensitive configuration changes.
• Refactoring scattered print statements into a structured, append-only audit system.

Known limitations

Does not provide legal or compliance certification. Local validation depends on available test suites and database access within the environment.