What is an audit log?

What goes wrong when an app has no audit log?

A prototype rarely records anything beyond errors. Then a customer asks who deleted their project, a team member's access has to be investigated, or a security questionnaire asks how you trace administrative actions. Without an audit log, the honest answer is that nobody knows.

Which actions belong in an audit log?

An audit log should record the actions someone may later need to trace: sign-ins and failed sign-ins, changes to roles and permissions, anything staff do inside customer accounts, exports, deletions and billing changes, and actions taken by AI agents or integrations, attributed to the person who allowed them.

• Sign-ins, failed sign-ins and changes to roles and permissions.
• Anything staff do inside customer accounts.
• Exports, deletions and changes to billing.
• Actions taken by AI agents or integrations, attributed to the person who allowed them.

What should each audit log entry record?

OWASP's Logging Cheat Sheet puts it as when, where, who and what: the date and time, the application, the source address, the user's identity, and the type of event. Just as important is what to leave out, such as passwords and access tokens.

OWASP lists passwords, session identifiers (store a hash if you need to follow a session), access tokens, encryption keys and payment card data as things that must not be logged.

How do you stop an audit log from being edited?

NIST SP 800-53 has a control for exactly this, AU-9, Protection of Audit Information. OWASP's practical version: build in tamper detection so you know if a record was changed or deleted, restrict who can read logs and review that access, record all access to the logs themselves, and copy them to read-only storage as soon as you can.

In a database, that usually means a table the app can insert into but never update or delete from.

What audit logs does Supabase give a Lovable app?

Supabase Auth records authentication events, including sign-ups, sign-ins, password changes and recovery, email verification, token refresh and sign-out. They are kept in Supabase's log storage, and can also be written to the auth.audit_log_entries table, where you can search them with SQL. Separately, platform audit logs record what your team members do in the dashboard, on Team and Enterprise plans only.

Neither records what users do inside your app: who deleted a project, who exported a customer list. That log is yours to build, usually with role-based access control deciding who can read it. The production readiness check asks whether you have one, and an audit log is part of what an auditor looks for in SOC 2.