I built a tiny library that makes your audit logs tamper-evident
Most apps keep an audit log — who did what, and when. An admin deleted a user, a payment went through, a permission changed. And most of those logs sit in a database table or a file that anyone with access can silently edit or delete after the fact. A rogue insider, an attacker covering their tracks, even an honest bug — nothing stops a past log line from being quietly rewritten, and nothing lets…
Most applications maintain audit logs that record user actions, timestamps, and modifications. Unfortunately, these logs can be easily tampered with by malicious insiders, attackers, or even honest bugs. This creates a serious problem for systems that rely on audit logs as evidence for compliance, security investigations, or billing disputes.
If someone later claims that a record has been altered, there is no way to prove otherwise. The author encountered this issue repeatedly, and found that the common solution involved manually implementing a hash chain. To address this common problem, the author created a small library called chainlog.
chainlog takes an existing audit log and makes it tamper-evident. Each log entry contains a SHA-256 hash that includes the entry's content, an index, the timestamp, and the hash of the previous entry. This creates a chain of entries where altering any past entry will cause subsequent hashes to no longer match. By calling the verify() function, the entire chain can be verified in a single pass, revealing exactly where the tampering occurred.
The library provides various options for storing the audit log, including in-memory, JSONL-file, and SQLite databases.
While chainlog does not prevent writes to the log, it can detect if the log has been altered. For stronger guarantees, the head hash of the log should be anchored outside of the log, such as by emailing it, committing it, or timestamping it. This allows any full rewrite of the log to be detected. chainlog is currently implemented in TypeScript, with memory, file, and SQLite storage options available.
The author plans to add adapters for other databases like Postgres, MySQL, and MongoDB, as well as Python and PHP ports. The code is open source under the MIT license, encouraging anyone to contribute or use it for their own applications. The GitHub repository can be found at https://github.com/webfixerr/chain-log.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
