From 30047cbcf0f655b63acc2578df13f86ce8645594 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Tr=C3=A1vn=C3=ADk?= <jakub.travnik@gmail.com>
Date: Mon, 1 Dec 2025 16:56:59 +0100
Subject: [PATCH] audit logging on recoveryKey export

---
 app/server/modules/lifecycle/config-export.controller.ts | 1 +
 1 file changed, 1 insertion(+)

diff --git a/app/server/modules/lifecycle/config-export.controller.ts b/app/server/modules/lifecycle/config-export.controller.ts
index bc1e7176..cae50714 100644
--- a/app/server/modules/lifecycle/config-export.controller.ts
+++ b/app/server/modules/lifecycle/config-export.controller.ts
@@ -274,6 +274,7 @@ export const configExportController = new Hono()
 			if (includeRecoveryKey) {
 				try {
 					recoveryKey = await Bun.file(RESTIC_PASS_FILE).text();
+					logger.warn("Recovery key exported - this is a security-sensitive operation");
 				} catch {
 					logger.warn("Could not read recovery key file");
 				}