PostHog Feature Flag Audit Log in Google Sheets with Slack Alerts

PromptCreate

Every night at 11pm in my workspace timezone, run a deterministic audit of every PostHog feature flag change from the previous 24 hours, append the results to a Google Sheet, and ping Slack when a high-blast-radius flag is touched. Build this as a code workflow because every step is a fixed-schema CRUD call with no natural-language synthesis.

Trigger: cron at 23:00 daily.

Step 1. Call PostHog List Feature Flags to enumerate every active flag in the project.

Step 2. For each flag returned, call PostHog Get Feature Flag Activity Log filtered to events with a timestamp in the last 24 hours.

Step 3. For every activity entry, call Google Sheets Append Values on my "Feature Flag Audit" spreadsheet. Write one row per entry with these columns, in order: timestamp, flag key, change type (created, updated, deleted, toggled, archived), rollout percentage before, rollout percentage after, who made the change (name and email when available), and a deep link back to the flag in PostHog.

Step 4. After all rows are appended, scan the new entries for any flag whose rollout percentage moved above 50% in this run, or whose targeting now includes the all-users group. Treat these as high-blast-radius changes.

Step 5. For each high-blast-radius entry, call Slack Send a Message to the #flag-changes channel with the flag key, the user who changed it, the new rollout percentage, and the deep link back to PostHog.

If nothing changed in PostHog in the last 24 hours, the workflow should finish silently. No empty Slack post, no header-only row appended. The Google Sheet is append-only and must never overwrite or delete prior rows.

What does this prompt do?

Builds an immutable, timestamped record of every PostHog feature flag change from the last 24 hours in a Google Sheet.
Logs who changed each flag, what the rollout was before and after, and a direct link back to the flag in PostHog.
Posts a Slack alert when a flag rolls out above 50% or starts targeting all users, so big releases never slip past the team.
Runs every night at 11pm with no manual work or copy and paste.

What do I need to use this?

A PostHog account with access to your feature flags.
A Google account with edit access to the spreadsheet you want to use as the audit log.
A Slack workspace and a channel to receive the high-risk flag alerts.

How can I customize it?

Change the 11pm run time if a different cutoff fits your team's day better.
Swap the Slack channel from #flag-changes to whichever channel your release or platform team watches.
Adjust the alert threshold (default 50% rollout) or add custom rules, like alerting on any change to flags tagged production.

FAQs

Will this overwrite my existing PostHog flag history?

No. PostHog still keeps its own activity log inside the app. This workflow only appends new rows to your Google Sheet so you have a separate, durable record outside of PostHog.

What happens on nights when nothing changed?

Nothing gets written to the sheet and no Slack message is sent. The workflow finishes quietly.

Can I track multiple PostHog projects?

Yes. Duplicate the workflow per project, or extend it to loop over a list of project IDs and write each one to its own tab in the same spreadsheet.

What counts as a high-risk flag change?

By default, any change that pushes the rollout above 50% or starts targeting the all-users group. You can raise or lower the threshold, or add your own rules in the workflow.

Do I need a paid PostHog plan?

No. Listing feature flags and reading the activity log are available on the free plan.

Related templates

Auto-fix your calendar when a flight slips, and flag what's at risk

When your flight moves, your calendar times get corrected automatically and you get a Slack note naming the meetings you're about to miss.

Agentic Task

Trace phishing emails to the sending IP and report abuse

Every 15 minutes, forwarded phishing reports get traced back to the server that really sent them, with a verdict in Slack and the worst senders reported.

Agentic Task

Weekly Amazon S3 bucket security audit posted to Slack

Every Monday, check every S3 bucket for public exposure, missing encryption and weak backup settings, then get the risks ranked in Slack.

Agentic Task

Turn procurement portal tenders into CRM deals each morning

Every weekday at 7am, sign in to the tender portals you track, filter new notices against your bid criteria, and open a deal for the ones worth chasing.