Repository navigation
Name alert and MFA audit events after what they report - #114
Merged
Merged
Conversation
The scheduled audit verification's alerts were recorded as audit_log.verify, which reads like the record of a routine (passing) run. A passing run records nothing; the action only appeared when verification was failing, and once when it passed again. They're now: - audit_log.verification_failed (status failed, or error when the run couldn't verify): the first failing run, a run with more failures than the last alert reported, and a daily reminder. - audit_log.verification_recovered (status success): the first passing run after failing. New Slack integrations route audit_log.verification_* to #security. ActionVerbVerify is gone: nothing records it (only a pattern-matching test used it as an example). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
|
Warning Review limit reached
This review includes 16 billable files and costs up to $4.00.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 21 seconds for your next included review. View limit details
Comment |
 |
|
Overall Grade |
Security Reliability Complexity Hygiene |
Code Review Summary
| Analyzer | Status | Updated (UTC) | Details |
|---|---|---|---|
| JavaScript |  |
Oct 12, 2026 7:36a.m. | Review ↗ |
| Go | |
Oct 12, 2026 7:36a.m. | Review ↗ |
Important
AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.
An MFA verification was recorded under three names: mfa_verification.create (the web routes, named after their shared permission), mfa.verify (a CLI login's MFA step) and mfa.verify.failed (the failure alert). And starting a WebAuthn verification, which only issues a challenge, was recorded as mfa_verification.create too. - Every MFA verification records mfa.verify (attempt, and result with status success or failed): POST /auth/mfa/verify, the WebAuthn assertion verify and a CLI login's MFA step. - Starting a WebAuthn verification records mfa.challenge. - The failure alert is mfa.verify_failed (like login.oauth_failed). It emails the user, and new Slack integrations now route it to #security. The routes are named in rbac's auditActions; a test in audit checks they match the audit constants. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
ndbroadbent
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two naming fixes for audit events, so Slack patterns and audit log searches match what people expect.
Verification alerts
Audit log verification alerts were recorded as
audit_log.verify, which reads like a record of every verificationrun. A passing run records nothing; the events are alerts. They're now:
audit_log.verification_failed: verification is failing (statusfailed, orerrorwhen the run couldn'tverify). Sent on the first failure, when a run finds more failures, and as a daily reminder.
audit_log.verification_recovered: verification passes again after failing (statussuccess).New Slack integrations route
audit_log.verification_*to their #security channel.MFA verification
An MFA verification was recorded under three names:
mfa_verification.create(the web routes, named after theirshared permission),
mfa.verify(a CLI login's MFA step) andmfa.verify.failed(the failure alert). Starting aWebAuthn verification, which only issues a challenge, was recorded as
mfa_verification.createtoo.mfa.verify(attempt, then a result with statussuccessorfailed):POST /auth/mfa/verify, the WebAuthn assertion verify and a CLI login's MFA step.mfa.challenge.mfa.verify_failed(likelogin.oauth_failed). It emails the user, and new Slackintegrations now route it to #security.
Upgrading
Existing Slack integrations keep their patterns. The upgrade notes say to replace
audit_log.verifywithaudit_log.verification_*, and to addmfa.verify_failedto a security channel. Audit log searches for the oldnames find only older events.