Audit log and account security for game studios

How to protect access to game source code and assets

Unreleased games leak. Sometimes it is a build, sometimes concept art, sometimes a design document that reveals the next title. In most cases the cause is not an exotic attack: it is an account. A reused password that appears in someone else's breach, a laptop left signed in at a convention, a contractor who kept access months after the end of the job.

A game team also has more accounts than people think: core staff, freelancers, outsourcing partners, QA vendors, voice actors' agencies, publishers. Each account that can see the project is a door.

The basics that stop most incidents

• A second step at sign-in, so a stolen password alone is not enough.
• Passwords that are hard to guess and that do not appear in public breach lists.
• Visibility on where each account is signed in, with a way to end a session you do not recognise.
• An audit trail: when something goes wrong, you need to answer "who did this, and when" without guessing.
• Least privilege: each person sees only the projects and features they need. See roles and permissions.

How Gameheim protects accounts and records activity

An audit log for the studio

Gameheim records significant actions with who did them, when, a short summary and the project they belong to. The log covers tasks, bugs and decisions, file locks and force-unlocks, projects and their pipeline phase, users and role assignments, wiki pages and documents, voice acting and music, capacity planning, calendar events and announcements, sign-in security events (such as regenerated backup codes or a new biometric device), agent sign-ins, and external apps connected to the organization. Changes made through an AI assistant or another connected app are recorded too.

The Audit Log page is available to LEADs and to anyone whose role includes the audit_log:read permission, and shows the most recent entries of your own organization. Audit records are kept and are not purged automatically. A LEAD can also download every audit record, together with the rest of the organization's data, from Settings → Data & privacy → Download export.

Two-factor authentication

Each person can turn on two-factor authentication with an Authenticator app (codes from an app on the phone, with backup codes) or Email codes (a one-time code emailed at each sign-in). A LEAD can make it mandatory for the whole organization: members who have not set it up are shown a Set up two-factor authentication dialog they cannot skip.

Password rules and breach check

• At least 10 characters, with an uppercase letter, a lowercase letter and a digit.
• It must not contain your username, your name or your organization name, nor the product or company name.
• It must not appear in public breach databases from other services. The check sends only a short prefix of a hash of the password, never the password itself.
• Changing your password signs you out of every device, and turns off fingerprint and face sign-in everywhere until you turn it back on.

Sessions, devices and agents in one place

Under Settings → Security, the Account access card lists everything that can get into your account: Active sessions, Trusted devices (devices that skip the verification code), Biometric sign-in (phones that sign in with a fingerprint or face) and Registered agents (the desktop agents that run Perforce with your credentials). Each one can be removed on its own.

Per-organization encryption

Sensitive data, including Perforce credentials, is encrypted at rest with AES-256/GCM under keys that belong to your organization only. A LEAD sees the current key version and its fingerprint in Settings → Organization → Encryption Key, and can rotate the key there. Organizations are strictly isolated from each other. The security page summarises the rest of the protections.

How to secure your studio accounts in Gameheim

1. 1

   Turn on two-factor authentication for your account

   Open Settings → Security. Under Two-factor authentication is off, choose Authenticator app or Email codes. For an authenticator app, scan the QR code (or enter the key manually), type the 6-digit code and click Verify & enable. Save the backup codes that appear: they are shown once, and each works once if you lose your phone.

2. 2

   Require two-factor authentication for everyone

   As a LEAD, open Settings → Organization and find the Two-factor authentication card. Switch Require MFA for all members to Required, choose the Allowed methods, and set the Trusted device window: how many days (0 to 30, 7 by default) a device ticked with Remember this device may skip the code. Save.

   Tip:Set the trusted device window to 0 if your team often signs in from shared machines, such as build or test PCs.
3. 3

   Review the audit log

   In the sidebar, under Administration, open Audit Log. The table shows Time, Action, Actor, Summary and Project. When a change was made through an AI assistant or the API, the actor carries a label with the app, for example via Claude; an app that has not proved its identity is marked as unverified. Use the All actions filter to narrow the list to a group (Tasks, Files, Projects, Users, External apps) or to a single action, for example File unlocked or External app connected.

4. 4

   Check where your account is signed in

   In Settings → Security → Account access, open Active sessions. Each row shows the device, when it signed in and when it was last active. Sign out any session you do not recognise. Locations are approximate: a VPN or a mobile carrier can place a session in the wrong city.

5. 5

   React to a suspected compromise

   If you think someone else has access, click Sign out everywhere & disable biometric sign-in. It signs out every device and turns off biometric sign-in everywhere, including the device you are using. Then change your password, check Registered agents and revoke any machine you do not know, and tell your LEAD so they can review the audit log.

Audit log reference: common actions and filters

Actions outside these groups (bugs, decisions, roles, wiki, documents, voice acting and others) still appear in the list with their own name when you leave the filter on All actions.

Audit trail for Perforce locks and force-unlocks

In a team that works on binary assets, a lock is a promise: "I am editing this map, do not touch it". Removing someone else's lock is sometimes necessary (they are on holiday, the lock is stale), but it should never be silent. In Gameheim every force-unlock is recorded under the username of the person who did it. See Perforce file locking for Unreal assets.

Dual approval for destructive Perforce admin actions

In Settings → Organization, a LEAD can turn on Dual approval. When enabled, destructive admin actions (deleting a Perforce user, group or depot, and permission updates) need a second eligible admin to approve before they apply. Approvals expire automatically after the time you set, between 24 and 336 hours. See Perforce server administration.

Troubleshooting sign-in and security

• "This password appears in public breach databases": your Gameheim account is not affected, but that password is known to attackers. Choose a different one.
• Lost phone with the authenticator app: at sign-in, enter one of your backup codes instead of the 6-digit code. Then set up two-factor authentication again and regenerate backup codes.
• "Too many attempts": wait a minute and try again. Repeated failures are rate-limited to slow down password guessing.
• "Your account has been deactivated": a LEAD of your organization deactivated the account. Ask them to reactivate it.
• Biometric sign-in stopped working after a password change: that is intended. Sign in with your password and turn it back on in Settings → Security.

Frequently asked questions