diff --git a/website/content/docs/audit/index.mdx b/website/content/docs/audit/index.mdx index bc2210bf06..9b1314fbb8 100644 --- a/website/content/docs/audit/index.mdx +++ b/website/content/docs/audit/index.mdx @@ -32,7 +32,7 @@ unique identifier assigned to each request. Most strings contained within requests and responses are hashed with a salt using HMAC-SHA256. The purpose of the hash is so that secrets aren't in plaintext within your audit logs. However, you're still able to check the value of secrets by generating HMACs yourself; this can be done with the audit device's hash function and salt by using the `/sys/audit-hash` API endpoint (see the documentation for more details). -~>** Note:** Currently, only strings that come from JSON or returned in JSON are +~> Currently, only strings that come from JSON or returned in JSON are HMAC'd. Other data types, like integers, booleans, and so on, are passed through in plaintext. We recommend that all sensitive data be provided as string values inside all JSON sent to Vault (i.e., that integer values are provided in quotes).