fastcurve-audit-log
Admin audit trail with hashed login source fingerprints; reads users only to label actors.
Description
EmDash plugin: login activity and admin action audit log with optional login email alerts.
Audit summary
Security risk answers “can this plugin harm my site?” — it drives the publish decision. Privacy disclosure answers “what visitor or admin data does this plugin handle?” — it’s informational so you can make your own GDPR call before installing.
- mediumpermissionsPlugin reads user data
Embed in README
Paste any of these snippets into your plugin’s README so readers see live installs, trust tier, audit verdict, version, EmDash compatibility, and lifecycle.
Per-badge markdown snippets
installsversiontrust-tieraudit-verdictcompatlifecycleVersion history
Rejected and revoked versions remain visible so the history is honest. Expand any row with findings to see why. See our review policy.
1.0.2PublishedPassed7.6 KB9 Aug 202613 downloads
Scanner findings (1)
Plugin reads user data
read:users grants access to the user table. Verify the plugin only reads what it strictly needs and never transmits PII off-host.
1.0.1FlaggedWarning7.1 KB8 Aug 202614 downloads
Scanner findings (4)
Plugin reads user data
read:users grants access to the user table. Verify the plugin only reads what it strictly needs and never transmits PII off-host.
Potential IP Address Logging
The plugin logs IP addresses for audit purposes, which may include visitor IPs. This is stored in the plugin's KV namespace. See `function a(e)` and `function o(e)`
Environment Variable Access
The plugin accesses environment variables using `process.env`, which is blocked by the sandbox. See `function O(e)`
Potential Unhandled Rejections
The plugin uses `await` without proper error handling in several places, which may lead to unhandled rejections. See `async function h(e,t)`
1.0.0PublishedPassed7.1 KB8 Aug 202615 downloads
Scanner findings (1)
Plugin reads user data
read:users grants access to the user table. Verify the plugin only reads what it strictly needs and never transmits PII off-host.