Skip to content

security: audit log lacks deterministic rotation & quota enforcement #450

Description

@nanaf6203-bit

Summary

src/utils/security/auditLogger.ts keeps an audit log in localStorage with no obvious rotation or eviction policy.

Affected area

src/utils/security/auditLogger.ts (private cleanupOldLogs)

Steps to reproduce / impact

Quota exhaustion will silently drop log entries, defeating the audit guarantee. Without a strict, tested rotation policy, the most recent (most important) entries can be evicted first.

Expected behaviour

Implement LRU-by-time with size cap; surface a warning when eviction begins; export to remote sink before eviction.

Acceptance criteria

  • Tests for rotation behaviour.
  • Documentation of the audit retention policy.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

Stellar WaveIssues in the Stellar wave programpriority/p2P2 — medium prioritysecuritySecurity issue or hardening opportunity

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions