Append-only feed of security-audit events. Auto-refreshes every 10 seconds. Filter by event type, email, or IP to investigate spikes.