Security & compliance
What are audit logs?
An immutable record of who did what in the tool, such as settings changed, findings dismissed or gates bypassed.
Audit logs answer questions after the fact: who suppressed this vulnerability, who disabled that gate, who added an external user. For SOC 2 and ISO 27001 they are table stakes rather than a nice-to-have.
The security-relevant events here are the suppressions and bypasses. A dismissed critical finding with no attached record of who dismissed it and why is a genuine gap, not an administrative one.
What to look for
- Retention period, and whether it satisfies your compliance framework
- Export to your SIEM, via API or streaming
- Whether finding dismissals and gate bypasses are captured, not just logins
- Whether logs are tamper-evident
Best 19 code quality, security and code review tools with audit logs
Every tool in the directory whose documentation covers this, 17 fully and 2 partially. Full support is shown first. Shown in a random order that changes on every visit, so no tool gets an advantage from its position.
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.
Code Security Platform
AikidoActivity log records issue actions such as snooze, ignore, severity changes and AutoFix PRs; API export needs Basic.
AI Coding Agent
ChatGPT / CodexChatGPT Enterprise supports audit logging; Compliance API adds an append-only log stream for SIEM.
Code Security Platform
Checkmarx OneAudit Trail API/UI logs user management, SAST triage, and reporting events; 365-day default retention.
AI Coding Agent
Claude CodeAudit logging listed among cloud/web session execution safeguards for Anthropic-managed VMs.
Code Quality Platform
CodacyOrg-wide event audit logs with CSV/JSON/API export and 90+ day retention; Business plan only.
PR Review Tool
CodeAnt AISSO & Audit Log is an Enterprise Plan inclusion; an audit events API exports organization events for ingestion.
PR Review Tool
CodeRabbitSearchable admin change history plus REST API for SIEM export; Enterprise plan only
Code Security Platform
CorgeaAudit Logs is an Enterprise-only pricing inclusion
PR Review Tool
Cursor (Bugbot)Enterprise audit logs cover Bugbot installs, rules and settings; stream to SIEM, S3 or webhooks.
Code Quality Platform
DeepSourceAudit logs listed in the Team plan; Enterprise Control Panel adds audit logging for enterprise admins.
Code Security Platform
GitHub Advanced SecurityOrganization/enterprise audit log plus GraphQL Audit Log API for compliance monitoring and IP protection
PR Review Tool
GreptileAudit logging referenced as an enterprise feature; no scope, retention or export detail
Code Quality Platform
QltyAudit logs listed as Enterprise-only on the pricing comparison table
Code Security Platform
SemgrepTimestamped audit logs exportable in JSON covering scans, findings, policy violations and remediation with user attribution.
Code Security Platform
SnykAudit logs exist as platform data and can be scoped to a hosting region.
Code Quality Platform
SonarQubeOrganization activity, change history, and access/permission modification logs.
Code Security Platform
VeracodeUser activity log and audit trails documented for enterprise governance
AI Coding Agent
Gemini Code AssistPartialOptional Cloud Logging bucket can store inputs and responses; no dedicated admin audit log documented.
PR Review Tool
QodoPartial'Previous review results' keeps per-commit review history; no admin or access audit log documented
Related terms
FAQ
What are audit logs?
An immutable record of who did what in the tool, such as settings changed, findings dismissed or gates bypassed.
How many tools in the directory offer audit logs?
19 of the 20 tools in this directory offer audit logs, 17 fully and 2 partially:
Support is not the same as parity, since some implementations are narrower in scope, gated to a higher plan tier, or maintained only for existing customers. The note under each tool is what its own documentation describes.
What should you check when comparing tools with audit logs?
Four things:
- Retention period, and whether it satisfies your compliance framework
- Export to your SIEM, via API or streaming
- Whether finding dismissals and gate bypasses are captured, not just logins
- Whether logs are tamper-evident