Inspect PyPI event logs to audit your account’s and project’s security
August 15, 2019
This beta feature is live now on PyPI and on Test PyPI.
We're further increasing the security of the Python Package Index with another new beta feature: an audit log of sensitive actions that affect users and projects. This is thanks to a grant from the Open Technology Fund, coordinated by the Packaging Working Group of the Python Software Foundation.
|Project security history display, listing|
events (such as "file removed from release version 1.0.1")
with user, date/time, and IP address for each event.
In your account settings, you can view a log of sensitive actions from the last two weeks that are relevant to your user account, and if you are an Owner at least one project on PyPI, you can go to that project's Manage Project page to view a log of sensitive actions (performed by any user) relevant to that project. (And PyPI site administrators are able to view the full audit log for all users and all projects.)
Please help us test this, and report issues.
|User security history display, listing|
events (such as "API token added")
with additional details (such as token scope), date/time,
and IP address for each event.
We're still refining this and may fail to log, or to properly display, events in the audit log. And the sensitive event logging and display starting on 16 August 2019, so you won't see sensitive events from before that date. (Read more technical details about implementation in the GitHub issue.)
We're continuing to refine all our beta features, while working on accessibility improvements and starting to work on localization on PyPI. Follow our progress reports in more detail on Discourse.
>>> Read the Full Story at Python Insider