gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-07-26 11:49:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs: reflect Community tier rebalance for scanning, audit log, and registries (#1340)

Browse Source 
Update tier mentions for the capabilities now available on Community:
- Trivy managed auto-update, single-scan SBOM export, node labels, and the
  fleet topology layout modes are present-tense Community features.
- The audit log documents a 14-day recent-activity window on every tier, with
  CSV/JSON export, anomaly detection, and configurable retention as Admiral.
- Private registries split Docker Hub / GHCR / custom (every tier) from AWS ECR
  (Admiral). SARIF export and deploy enforcement stay Admiral.

Also removes two fence-spec phrasings (per-tier label cell and 'visible on
Admiral' for the audit tab) in favor of stating each requirement once.
This commit is contained in:
Anso
2026-06-08 08:59:58 -04:00
committed by GitHub
parent 2298f470bd
commit 45c004e1cd
9 changed files with 50 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/reference/security.mdx
+7 -4
View File
@@ -88,11 +88,14 @@ Every Sencho instance includes the foundational security stack. Advanced access-
| Multi-user with RBAC (Admin, Viewer) | ✓ | ✓ |
| Webhook signatures (HMAC-SHA256) | ✓ | ✓ |
| API tokens (scoped, expiring) | ✓ | ✓ |
| Scan policies and SBOM generation | | ✓ |
| SBOM generation (SPDX, CycloneDX) | ✓ | ✓ |
| Recent-activity audit log (14-day window) | ✓ | ✓ |
| Scan policies (`block_on_deploy`) | | ✓ |
| SARIF export | | ✓ |
| Fleet Secrets (encrypted env-var bundles) | | ✓ |
| Advanced RBAC (Deployer, Node Admin, Auditor) | | ✓ |
| Scoped permissions (per-stack, per-node) | | ✓ |
| Audit log with export | | ✓ |
| Audit log export, anomaly detection, and extended retention | | ✓ |
## Password authentication
@@ -207,7 +210,7 @@ For user management and scoped permissions, see [RBAC & User Management](/featur
Every POST, PUT, DELETE, and PATCH request to the API is recorded in the audit log with the acting username, IP address, HTTP method, response status, and an auto-generated summary. GET requests are excluded to keep the log focused on mutations.
The audit log is searchable by keyword (actions, paths, usernames) and filterable by HTTP method and date range. Results can be exported as CSV or JSON (up to 10,000 entries per export). Retention defaults to 90 days and is configurable from 1 to 365 days in **Settings · Operations · Data Retention**.
The audit log is searchable by keyword (actions, paths, usernames) and filterable by HTTP method and date range. The recent-activity log, scoped to the last 14 days, is available on every tier. With Admiral, results can be exported as CSV or JSON (up to 10,000 entries per export), entries carry anomaly annotations, and retention defaults to 90 days and is configurable from 1 to 365 days in **Settings · Operations · Data Retention**.
The **Auditor** role provides read-only access to the audit log without any other administrative privileges, making it suitable for compliance reviewers who should not have access to system settings.
@@ -215,7 +218,7 @@ The **Auditor** role provides read-only access to the audit log without any othe
<img src="/images/audit-log/audit-log-overview.png" alt="Audit log table showing recent actions with method badges and status codes" />
</Frame>
For details, see [Audit Log](/features/audit-log). Admiral tier.
For details, see [Audit Log](/features/audit-log).
## Encryption at rest