Audit Logs

LaunchKit Pro maintains an append-only audit trail for security-sensitive and workspace actions.

Configuration

AUDIT_LOG_ENABLED=true
AUDIT_LOG_RETENTION_DAYS=90

When AUDIT_LOG_ENABLED=false, new audit events are not written (friendly no-op).

What is logged

Examples of covered actions:

• Auth: register, login, logout, login failures (no passwords)
• Workspace & members: create, update, invites, role changes
• Billing: checkout, subscriptions, webhook received
• AI: generation success, blocked, failure
• Storage: upload, delete
• Developer: API key created/revoked, webhooks created/tested
• License: activate, revoke, activation failures
• Demo: blocked actions, reset/seed attempts
• Queues: pause, resume, clean (admin)
• Search: reindex (admin)
• Contact & support: message/ticket created

What is never logged

Audit metadata is sanitized. These are never stored:

• Full API keys or license keys
• Webhook signing secrets
• Passwords, JWTs, refresh tokens
• Provider API keys or env values
• Raw request bodies with sensitive fields

Values matching lk_* key patterns are masked in metadata.

API endpoints

Method	Route	Access
GET	/audit-logs/me	Current user
GET	/workspaces/:workspaceId/audit-logs	audit.view permission
GET	/admin/audit-logs	Platform admin

Frontend

• User/workspace activity: /dashboard/activity
• Platform admin: /admin/audit-logs (filters by action, pagination)

Retention

AUDIT_LOG_RETENTION_DAYS documents the intended retention policy. A maintenance job placeholder exists for future automated cleanup via the maintenance queue.