Security & Audit
DD's security stack consists of three independent but complementary components, covering the full chain from data redaction to audit traceability.
Components
| Component | Responsibility | Typical Use Case |
|---|---|---|
| SensitiveDataFilter | Auto-detect and redact sensitive data in logs | Prevent passwords, API keys, credit card numbers from leaking |
| AuditLogger | Asynchronously log security-related events | Compliance audit, security analysis, intrusion detection |
| IntegritySigner | HMAC signing to prevent log tampering | Tamper detection, forensic evidence, compliance storage |
How They Relate
text
Log write pipeline:
Logger.InfoWith(...)
│
├─→ SensitiveDataFilter ──→ Redact field values (password → [REDACTED])
│ │
│ └─→ AuditLogger ──→ Async record redaction events
│
├─→ Format output
│
└─→ IntegritySigner ──→ HMAC sign (tamper protection)- SensitiveDataFilter intercepts sensitive data before logs are written
- AuditLogger records security events asynchronously without impacting log performance
- IntegritySigner signs logs after writing to ensure chain integrity
Quick Selection
| Need | Recommended |
|---|---|
| Prevent password/key leakage | SensitiveDataFilter |
| Record who did what and when | AuditLogger |
| Ensure logs haven't been tampered | IntegritySigner |
| Meet HIPAA/PCI-DSS compliance | All three together — see Compliance |
Related Guides
- Sensitive Data Filtering -- Auto-redaction tutorial
- Audit Logging -- Security audit guide
- HMAC Signing in Practice -- Integrity signing deep dive
- Compliance Configuration -- HIPAA/PCI-DSS presets
- Production Checklist -- Pre-launch security checks
Next Steps
- Security Filtering -- SensitiveDataFilter full API
- Audit Logging -- AuditLogger full API
- Integrity Signing -- IntegritySigner full API