Documentation · Audit

Audit and sessions

Warden records attributable security evidence and gives users control over active browser sessions.

Versioned event envelope

Each new SQLite event records schema version, request ID, action, target path, outcome, account, login identity, client address, bounded detail and timestamp. The response X-Warden-Request-ID correlates a client-visible failure with its audit event. System → Audit returns at most 500 recent events to users with audit.read.

{
  "schemaVersion": 1,
  "requestId": "request-123",
  "action": "authorization_denied",
  "target": "/api/admin",
  "outcome": "denied"
}

Redaction and retention

Central redaction removes password, token, secret, credential, authorization, recovery-code, TOTP, API-key and session values before file or SQLite output. Details are capped at 4 KiB, query strings are excluded from targets and the database retains at most 100,000 events. Earlier audit.log records import idempotently as legacy evidence.

Attributable does not mean tamper-proof.

An attacker or operator with write access to Warden's configuration directory can alter SQLite and file logs. Forward events to a separately administered system when immutable retention is required.

Browser sessions

Security lists the current account's sessions with client address, user agent and expiry. Users can revoke individual sessions; administrators can revoke every session belonging to an account. Session state is normalized into SQLite while the compatibility projection preserves existing backup behavior.

Deletion boundary

Workspace files are external data.

Removing an identity or Warden account revokes its application access and state. It does not delete repositories, home directories or workspace files.