audit.Entry (internal/audit/types.go) holds user, roles, method, path, operation ID, source IP, response code and duration. The middleware (internal/controller/api/middleware_audit.go) never reads the request body and does not record the job ID the handler creates.
Impact: after an incident the audit log can show who called command/shell against which host and when, but not what ran. File writes, sysctl values and cron content are equally unrecorded, and an audit entry cannot be joined to the job's status timeline.
Fix: record a redacted summary of the request for mutating operations (command and arguments, target path, key) and the job ID. Agent-side events such as redelivery would make the trail complete.
Found in the September 2026 codebase review. Tracked in the review tracking issue.
audit.Entry(internal/audit/types.go) holds user, roles, method, path, operation ID, source IP, response code and duration. The middleware (internal/controller/api/middleware_audit.go) never reads the request body and does not record the job ID the handler creates.Impact: after an incident the audit log can show who called
command/shellagainst which host and when, but not what ran. File writes, sysctl values and cron content are equally unrecorded, and an audit entry cannot be joined to the job's status timeline.Fix: record a redacted summary of the request for mutating operations (command and arguments, target path, key) and the job ID. Agent-side events such as redelivery would make the trail complete.
Found in the September 2026 codebase review. Tracked in the review tracking issue.