[Security] Audit log records the request but never the outcome, and redaction is shallow so nested secrets are persisted

[grantfox-oss]

Telegram (ask questions / claim the issue here first): https://t.me/+DOylgFv1jyJlNzM0

Why this matters

backend/src/middleware/auditLog.ts:63-111 fires the INSERT and calls next() before the handler runs, so audit_logs has no HTTP status / allowed-vs-denied / success flag - a rejected admin action and a successful one are indistinguishable. sanitizePayload (auditLog.ts:8-30) only redacts top-level keys (shallow for now), so secret/token/signedTxXdr nested under e.g. body.tx are written to the DB in cleartext.

Acceptance criteria

• Record the response status/outcome (e.g. log on res finish or write a second row) so audit entries capture success/denial
• Make sanitizePayload recurse into nested objects/arrays to redact the sensitiveFields list at any depth
• Add tests covering a denied admin request and a nested signedTxXdr field

Files to touch

• backend/src/middleware/auditLog.ts

Out of scope

• Audit-log IP correctness (depends on trust proxy, tracked separately)
• Retention/cleanup job

[khanavi272-spec]

@khanavi272-spec has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @khanavi272-spec to this issue.

[Kappa16]

@Kappa16 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

PLEASE maintainer..I can handle this professionally and make sure this issue is closed ASAP WITHOUT ERRORS.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Kappa16 to this issue.

[SharifIbrahimDev]

@SharifIbrahimDev has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue

ℹ️ Repo Maintainers: To accept this application, review their application or assign @SharifIbrahimDev to this issue.

[ghost-cy829]

@ghost-cy829 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I would like to work on this issue. I have experience with Rust and Soroban smart contract development. I will follow the acceptance criteria and add tests. Excited to contribute. Kindly assign.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @ghost-cy829 to this issue.

[warisu]

@warisu has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hello I would like to handle this in less than 12hrs

ℹ️ Repo Maintainers: To accept this application, review their application or assign @warisu to this issue.

[drips-wave]

Congratulations, @SharifIbrahimDev! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @SharifIbrahimDev: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[grantfox-oss]

🦊 GrantFox — @SharifIbrahimDev has been assigned to this issue!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #1183)
2. Your PR will be reviewed by the LabsCrypt maintainers

Good luck! Track your progress on GrantFox.