Security

Signals worth watching: failed sign-ins, bad tokens, rate limits, probing.

Pattern

security.*

Written with

log()

Intents

Levels

warn

View as Markdown

Intents

security.signinwarn

A sign-in failed, or succeeded from somewhere unusual

security.tokenwarn

A bad or expired token, secret or signature was presented

security.limitedwarn

A caller hit a rate limit

Recording one

Name what happened. The intent sets the level and whether it alerts.

// A sign-in failed, or succeeded from somewhere unusual
log('security.signin', 'Sign-in failed', { email: 'ada@example.com', attempts: 3 });

// A bad or expired token, secret or signature was presented
log('security.token', 'Preview secret did not match', { ip: '203.0.113.7' });

// A caller hit a rate limit
log('security.limited', 'Rate limit hit on validate-feed', { ip: '203.0.113.7' });

Writes (security.signin)

{
  "intent": "security.signin",
  "level": "warn",
  "alert": false,
  "message": "Sign-in failed",
  "data": {
    "email": "ada@example.com",
    "attempts": 3
  },
  "time": "2026-10-09T12:00:00.000Z"
}

Is it a security entry?

Find the row that describes your case, and use the domain on the right.

If the problem is
Use
Who did what, kept as a record: things created, changed, deleted, and changes to access.
audit.*
Signals worth watching: failed sign-ins, bad tokens, rate limits, probing.
security.* this page
Something broke or degraded, and someone should look.
incident.*
Background work: syncs, backups, migrations, scheduled runs.
job.*
Detail for working on the code, dropped in production.
debug.*

For registry authors

Starter intents. These are the intents prongs add logs puts in your registry. Change levels through the level.* intents, and point log() at your logger.