Logging and monitoring architecture
Log sources
| Source | Security and operational value | Access consideration |
|---|---|---|
| Application monitoring | Exceptions, performance traces, release context, selected replay and application logs | Minimise personal data; mask sensitive fields; restrict replay and source-map access |
| Supabase Logs Explorer | API, database, authentication, storage, realtime, and serverless service events | Retention depends on plan; administrator access and exports require control |
| Supabase security advisor | Configuration and database-security findings | Findings need ownership, disposition, and review dates |
| Cloudflare Pages | Deployment history and build logs | Build metadata is present; secret values are excluded from retained and public evidence |
| Cloudflare security analytics/events | Edge traffic and mitigated-request evidence where configured and entitled | Capability and retention depend on plan and zone configuration |
| Application audit records | Sensitive workflow transitions and business attribution | Retention and access approval is not currently available |
Operating requirements
- alert on authentication abuse, privileged failures, repeated authorization denials, provider callback failures, elevated error rates, and critical workflow breakage;
- use role-limited access and review administrator activity;
- redact secrets, credentials, tokens, payment data, document contents, and unnecessary personal data;
- preserve timestamps, correlation identifiers, actor, tenant, action, target class, and outcome where appropriate without exposing sensitive payloads;
- link confirmed events to incident response and vulnerability management;
- review retention, alert routing, on-call ownership, and test notifications at least quarterly.
Security event catalogue
| Event family | Minimum attributes | Detection use |
|---|---|---|
| Authentication | Outcome, method, time, coarse client context, account state, and correlation reference without passwords or raw tokens | Repeated failures, anomalous success, disabled-account use, refresh or recovery abuse |
| Authorization | Actor, tenant context, target class, operation, policy result, and denial reason class | Cross-tenant probes, repeated forbidden operations, privilege misuse, policy regression |
| Privileged operation | Initiating actor or workload, target, approved operation, result, duration, and change reference | Administrator misuse, abnormal bulk action, unapproved configuration or data change |
| Provider callback | Provider class, correlation reference, authenticity result, replay result, normalized status, and processing outcome | Forged callback, duplicate event, delivery gap, reconciliation mismatch |
| Data export and document access | Actor, scope, record class, volume band, result, and business reason where required | Unusual export, bulk access, sensitive-object access, failed ownership checks |
| Application exception | Release, route or operation class, error fingerprint, trace, affected tenant band, and redacted diagnostic context | New regression, repeated workflow failure, availability degradation |
| Deployment and recovery | Provider, environment, release or recovery point, actor, result, and rollback linkage | Unauthorized release, failed build, configuration drift, incomplete recovery |
Telemetry becomes actionable only after a rule or human review assigns severity, owner, and response deadline. Alerts use deduplication and correlation so one incident does not create unbounded noise. Monitoring cannot authorize a business operation; missing telemetry never converts a failed or unknown provider action into success.
Current limitations
Application and provider logging capabilities are present, but a complete retention matrix, central correlation strategy, verified security alerts, on-call roster, and account-level Cloudflare security-event configuration were not available. Supabase changed its Management API logging endpoint in 2026. Operational log integration is not confirmed against the current interface.