Security Logging and Monitoring Failures Skill

Security logging failures mean that when an attack happens, nobody can tell. No audit trail. No structured events. Logs that exist but contain no useful fields. An agent writing authentication or data access code produces code that works. It does not produce code that can be investigated after a breach.

What to Log Before Shipping Security-Sensitive Code

Every security-sensitive operation must emit a structured log event with these fields at minimum:

• timestamp — ISO 8601, UTC
• event_type — machine-readable category (auth.login.success, auth.login.failure, access.denied, data.export, admin.action)
• user_id — the authenticated identity, or anonymous if not authenticated
• ip_address — source IP of the request
• resource — what was accessed or attempted
• result — success or failure
• reason — for failures, a specific reason (not just "error")

Security events that require logging: