Repository navigation
feat(security): audit log detections, alert rules that count audit events - #2532
Merged
Merged
Maple Review Bot / Maple / review
succeeded
Nov 13, 2026 in 20s
Confidence 10/10 · No issues found
🟢 Confidence 10/10 · safe to merge. The delta since the last review is only base-branch merges this PR does not modify; its own content is unchanged since d60d7b5 and has no open findings.
no findings · tests covered · risk high
Nothing new to review: the four files changed since the previous review are base-branch merges of shared UI tokens, sidebar and table styles that d8dd5ff..839c56f does not touch. The detection work itself is unchanged since d60d7b5 and no earlier finding remains open.
Before merge
- Migration · Check it is safe on production data and with the code still deployed ·
packages/db/drizzle/20261113122938_alert_rules_audit_detection/migration.sql
Production impact
Production traffic of the changed files (last 7 days)
| File | Calls/day | Busiest operations |
|---|---|---|
apps/api/src/routes/internal/audit-trail.http.ts |
3.0k | maple 3.0k/day, 2.1% err |
apps/web/src/page/alerts/incident/view.ts |
53 | preview 53/day, 1.1% err |
packages/backend/src/services/alerts/AlertDeliveryDispatch.ts |
40 | test 40/day, 14.9% err |
Telemetry this change adds and removes (6)
- ➕ span name
AuditDetectionsService.list·packages/backend/src/services/audit-trail/AuditDetectionsService.ts:152 - ➕ span name
AuditDetectionsService.get·packages/backend/src/services/audit-trail/AuditDetectionsService.ts:165 - ➕ span name
AuditDetectionsService.create·packages/backend/src/services/audit-trail/AuditDetectionsService.ts:170 - ➕ span name
AuditDetectionsService.update·packages/backend/src/services/audit-trail/AuditDetectionsService.ts:225 - ➕ span name
AuditDetectionsService.remove·packages/backend/src/services/audit-trail/AuditDetectionsService.ts:291 - ➕ span name
AuditTrailService.count·packages/backend/src/services/audit-trail/AuditTrailService.ts:155
What was checked
git diff --stat d8dd5ff 839c56flists 44 files, none of them the token/sidebar/table files; they are identical to the base branch- The 69 changed lines since d60d7b5 all arrive from the
audit-trail/vercel-gcpbase merge, not from this PR's commits
839c56f · Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.
Loading