drop azure devops audit log · parse user + repo + pipeline events · runs locally
flags pat creation · permission elevation · pipeline variable changes · repo force-push
heuristic screener · field names vary by export version · indicative only · not definitive proof