There is no audit logging anywhere in the dashboard server — grep -rni "audit" packages/ts-cloud/src/deploy returns no hits.
Destructive operations execute with no record of who performed them:
- user removal —
local-dashboard-server.ts:999 - site deletion —
:817 - SSH key deletion —
:720 - firewall changes —
:762 - shell command execution —
:1031
On a box hosting multiple tenants (the attachTo shared-box model), this makes incident response and after-the-fact attribution impossible: there's no way to answer "who removed this site, and when".
Suggested fix
Append-only audit log capturing actor, action, target, timestamp, and outcome for every state-changing endpoint — written server-side in the guard/handler layer rather than per-route, so new endpoints are covered by default.