Integration token, cloud provider token and cloud-init script edits
were audit-logged under the session team. After a team switch in
another tab, the owning team missed the entry and the other team saw
the resource name.
- Use the team of the edited resource for every audit row
- Remove credentials, query and fragment from secret manager base URLs
in the audit log
Changing the Vault base URL or namespace, or the Infisical base URL or
client ID, sent the stored secret to the new settings. The secret must now
be entered again, and base URL changes are audit logged.
Add an admin-only audit-events API endpoint and restrict audit-log UI access. Record integration token and secret manager changes, key access, and references in audit events.
Add Doppler, Infisical, and Vault integrations with per-resource secret links, autocomplete, and deploy-time resolution for applications, services, and databases without persisting remote values.
Andras Bacsai