Finding
The \�udit_events\ table is a regular SQLAlchemy model with no trigger, policy, or application-layer guard preventing UPDATE or DELETE.
Risk
A privileged user or compromised token can modify or delete audit history. No tamper-evident chain exists.
Location
- \�ackend/app/modules/tasks/models.py:455-476\ — \AuditEvent\ model
- \�ackend/app/modules/audit/repository.py\ — only provides \�dd_audit_event()\
Recommendation
- Add a database trigger or rule preventing UPDATE/DELETE on \�udit_events\
- At minimum, add an application-layer permission check that only POST is allowed
- Consider \pg_audit\ or an immutable log for critical events
Severity: Medium
Finding
The \�udit_events\ table is a regular SQLAlchemy model with no trigger, policy, or application-layer guard preventing UPDATE or DELETE.
Risk
A privileged user or compromised token can modify or delete audit history. No tamper-evident chain exists.
Location
Recommendation
Severity: Medium