require-audit-logging

Suggests audit logging for AI SDK operations.

📊 Rule DetailsCopy Anchor Link

🔍 What This Rule DetectsCopy Anchor Link

This rule identifies AI SDK calls that aren't preceded by logging statements. Audit logging is important for security monitoring and debugging.

❌ Incorrect CodeCopy Anchor Link

// No logging
async function handler() {
  const result = await generateText({
    prompt: userInput,
  });
  return result.text;
}

// Missing audit trail
export async function processRequest(req) {
  await streamText({
    prompt: req.body.message,
  });
}

✅ Correct CodeCopy Anchor Link

Hello

⚙️ OptionsCopy Anchor Link

🛡️ Why This MattersCopy Anchor Link

Insufficient logging makes it impossible to:

• Detect abuse - Identify malicious usage patterns
• Debug issues - Trace problems in production
• Audit compliance - Prove regulatory compliance
• Monitor costs - Track API usage

🔗 Related RulesCopy Anchor Link

• require-error-handling - Handle errors
• require-tool-confirmation - Log destructive operations

🔄 Changes in the 2026-10-10 FP/FN auditCopy Anchor Link

• experimental_telemetry / telemetry with isEnabled: true counts as audit logging. Logging calls are matched by callee path (console.log, logger.info, debug(...)), not by substring (showDialog() is not logging).

Known False NegativesCopy Anchor Link

The following patterns are not detected due to static analysis limitations:

Logging in Wrapper FunctionCopy Anchor Link

Why: Logging in called functions is not visible.

// ❌ NOT DETECTED - Logging in wrapper
await myGenerateText(prompt); // Wrapper has logging

Mitigation: Apply rule to wrapper implementations.

Custom Logger MethodsCopy Anchor Link

Why: Non-standard logger methods may not be recognized.

// ❌ NOT DETECTED - Custom logger
myLogger.audit('AI call', { prompt }); // Not in default patterns
await generateText({ prompt });

Mitigation: Configure rule for custom logger method names.

Centralized Logging MiddlewareCopy Anchor Link

Why: Framework-level logging is not linked.

// ❌ NOT DETECTED (correctly) - Middleware logs all AI calls
app.use(aiAuditMiddleware);

Mitigation: Document centralized logging. Consider rule exception.

Async LoggingCopy Anchor Link

Why: Logging scheduled for later may not be detected.

// ❌ NOT DETECTED - Deferred logging
const result = await generateText({ prompt });
queueAuditLog({ prompt, result }); // Async logging

Mitigation: Use synchronous logging before AI calls.

📚 ReferencesCopy Anchor Link

• OWASP ASI10: Logging & Monitoring
• CWE-778: Insufficient Logging

Error Message FormatCopy Anchor Link

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

⚠️ CWE-778 OWASP:A09 CVSS:5.3 | Insufficient Logging detected | MEDIUM [SOC2,ISO27001,PCI-DSS,NIST-CSF]
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A09_2021/

Message ComponentsCopy Anchor Link