# Security

Signals worth watching: failed sign-ins, bad tokens, rate limits, probing.

Pattern: `security.*` (this page) · Written with: [`log()`](https://www.prongs.dev/docs/profiles/logs.md) · Intents: [3](#intents) · Levels: `warn`

## Intents

| Intent | Status | Use it for |
|---|---|---|
| [`security.signin`](https://www.prongs.dev/docs/intents/security/signin.md) | `warn` | A sign-in failed, or succeeded from somewhere unusual |
| [`security.token`](https://www.prongs.dev/docs/intents/security/token.md) | `warn` | A bad or expired token, secret or signature was presented |
| [`security.limited`](https://www.prongs.dev/docs/intents/security/limited.md) | `warn` | A caller hit a rate limit |

## Recording one

Name what happened. The intent sets the level and whether it alerts.

```ts
// A sign-in failed, or succeeded from somewhere unusual
log('security.signin', 'Sign-in failed', { email: 'ada@example.com', attempts: 3 });

// A bad or expired token, secret or signature was presented
log('security.token', 'Preview secret did not match', { ip: '203.0.113.7' });

// A caller hit a rate limit
log('security.limited', 'Rate limit hit on validate-feed', { ip: '203.0.113.7' });
```

Writes (security.signin)

```ts
{
  "intent": "security.signin",
  "level": "warn",
  "alert": false,
  "message": "Sign-in failed",
  "data": {
    "email": "ada@example.com",
    "attempts": 3
  },
  "time": "2026-10-09T12:00:00.000Z"
}
```

## Is it a security entry?

Find the row that describes your case, and use the domain on the right.

| If the problem is | Use |
|---|---|
| Who did what, kept as a record: things created, changed, deleted, and changes to access. | [`audit.*`](https://www.prongs.dev/docs/intents/audit.md) |
| Signals worth watching: failed sign-ins, bad tokens, rate limits, probing. | `security.*` (this page) |
| Something broke or degraded, and someone should look. | [`incident.*`](https://www.prongs.dev/docs/intents/incident.md) |
| Background work: syncs, backups, migrations, scheduled runs. | [`job.*`](https://www.prongs.dev/docs/intents/job.md) |
| Detail for working on the code, dropped in production. | [`debug.*`](https://www.prongs.dev/docs/intents/debug.md) |

## For registry authors

**Starter intents.** These are the intents `prongs add logs` puts in your registry. Change levels through the [`level.*`](https://www.prongs.dev/docs/intents/logs.md#level) intents, and point [`log()`](https://www.prongs.dev/docs/profiles/logs.md) at your logger.