Security monitoring

• Five or more destructive actions (deletions, rollbacks, revocations, removals) by one actor within 10 minutes.
• A revoked or expired API key being used; a key used from a new IP address.
• Members made owner/admin, admin invitations and full-access (*) API keys.
• Uploads with a wrong checksum or an invalid signature, and code signing being turned off.
• Production updates published straight to 100%.
• Prompt-injection attempts against agents and instruction-like text in workspace data.

Alerts appear on the Security page and in notifications; medium and high alerts are also sent to webhooks subscribed to security.alert. The Security sentinel agent can investigate them for you.