diff --git a/app.py b/app.py
index f84d5e8..85eeb1c 100644
--- a/app.py
+++ b/app.py
@@ -883,7 +883,13 @@ def _connect_with_jump_chain(host_id: int) -> tuple[paramiko.SSHClient, paramiko
     raise RuntimeError("failed to build jump chain")
 
 
+def is_audit_log_enabled() -> bool:
+    return os.getenv("ENABLE_AUDIT_LOG", "true").lower() in ("1", "true", "yes")
+
+
 def _insert_connection_audit(host_row: dict[str, Any]) -> int | None:
+    if not is_audit_log_enabled():
+        return None
     try:
         with db_cursor() as (_, cur):
             cur.execute(
@@ -964,9 +970,10 @@ def api_logout():
 @app.route("/api/me", methods=["GET"])
 def api_me():
     version = app.config.get("VERSION", "unknown")
+    audit_enabled = is_audit_log_enabled()
     if session.get("logged_in"):
-        return jsonify({"logged_in": True, "app_version": version})
-    return jsonify({"logged_in": False, "app_version": version})
+        return jsonify({"logged_in": True, "app_version": version, "audit_log_enabled": audit_enabled})
+    return jsonify({"logged_in": False, "app_version": version, "audit_log_enabled": audit_enabled})
 
 
 @app.route("/api/identities", methods=["GET"])
diff --git a/frontend/src/App.vue b/frontend/src/App.vue
index 1e4f5e5..a77b002 100644
--- a/frontend/src/App.vue
+++ b/frontend/src/App.vue
@@ -25,6 +25,7 @@ interface TabItem {
 const loggedIn = ref(false);
 const checking = ref(true);
 const appVersion = ref("unknown");
+const auditLogEnabled = ref(true);
 const identities = ref<IdentityRow[]>([]);
 const allHosts = ref<HostRow[]>([]);
 const allFolders = ref<FolderRow[]>([]);
@@ -347,6 +348,9 @@ onMounted(async () => {
     if (m.app_version) {
       appVersion.value = m.app_version;
     }
+    if (m.audit_log_enabled !== undefined) {
+      auditLogEnabled.value = m.audit_log_enabled;
+    }
     if (loggedIn.value) await refreshData();
   } catch {
     loggedIn.value = false;
@@ -918,6 +922,7 @@ async function deleteIdentityRow(id: number) {
           API keys
         </button>
         <button
+          v-if="auditLogEnabled"
           type="button"
           class="hidden rounded-lg px-3 py-1.5 text-xs text-slate-400 hover:bg-slate-800 hover:text-white md:inline-flex"
           @click="openAuditLog"
diff --git a/frontend/src/api.ts b/frontend/src/api.ts
index 39fd84c..1642243 100644
--- a/frontend/src/api.ts
+++ b/frontend/src/api.ts
@@ -21,7 +21,7 @@ function browseParams(folderId: number | null, q: string): string {
 }
 
 export const api = {
-  async me(): Promise<{ logged_in: boolean; app_version?: string }> {
+  async me(): Promise<{ logged_in: boolean; app_version?: string; audit_log_enabled?: boolean }> {
     const res = await fetch("/api/me", { credentials: "include" });
     return handle(res);
   },
@@ -318,16 +318,41 @@ export const api = {
     await handle(res);
   },
 
-  async sftpUpload(connId: string, path: string, file: File): Promise<void> {
+  async sftpUpload(
+    connId: string,
+    path: string,
+    file: File,
+    onProgress?: (loaded: number, total: number) => void
+  ): Promise<void> {
     const fd = new FormData();
     fd.set("path", path);
     fd.set("file", file);
-    const res = await fetch(`/api/sftp/${connId}/upload`, {
-      method: "POST",
-      credentials: "include",
-      body: fd,
+    return new Promise((resolve, reject) => {
+      const xhr = new XMLHttpRequest();
+      xhr.open("POST", `/api/sftp/${connId}/upload`);
+      xhr.withCredentials = true;
+      if (onProgress) {
+        xhr.upload.onprogress = (e) => {
+          if (e.lengthComputable) {
+            onProgress(e.loaded, e.total);
+          }
+        };
+      }
+      xhr.onload = () => {
+        if (xhr.status === 401) return reject(new Error("unauthorized"));
+        let data: any = {};
+        try {
+          data = JSON.parse(xhr.responseText);
+        } catch (e) {}
+        if (xhr.status >= 200 && xhr.status < 300) {
+          resolve();
+        } else {
+          reject(new Error(data.error || xhr.statusText));
+        }
+      };
+      xhr.onerror = () => reject(new Error("Network Error"));
+      xhr.send(fd);
     });
-    await handle(res);
   },
 
   sftpDownloadUrl(connId: string, path: string): string {
diff --git a/frontend/src/components/SftpPanel.vue b/frontend/src/components/SftpPanel.vue
index 9de810a..b3dead7 100644
--- a/frontend/src/components/SftpPanel.vue
+++ b/frontend/src/components/SftpPanel.vue
@@ -11,6 +11,7 @@ const err = ref("");
 const busy = ref(false);
 const renameTarget = ref<SftpEntry | null>(null);
 const newName = ref("");
+const uploadProgress = ref<number | null>(null);
 
 function isDir(m: number): boolean {
   return (m & 0o170000) === 0o040000;
@@ -66,11 +67,16 @@ async function onUpload(ev: Event) {
   input.value = "";
   if (!file) return;
   err.value = "";
+  uploadProgress.value = 0;
   try {
-    await api.sftpUpload(props.connId, path.value, file);
+    await api.sftpUpload(props.connId, path.value, file, (loaded, total) => {
+      uploadProgress.value = Math.round((loaded / total) * 100);
+    });
     await load();
   } catch (e) {
     err.value = e instanceof Error ? e.message : "Upload failed";
+  } finally {
+    uploadProgress.value = null;
   }
 }
 
@@ -186,7 +192,19 @@ function fmtSize(n: number): string {
     </div>
     <div class="min-h-0 flex-1 overflow-auto p-2">
       <p v-if="err" class="mb-2 text-xs text-red-400">{{ err }}</p>
-      <p v-if="busy" class="text-xs text-slate-500">Loading…</p>
+      <div v-if="uploadProgress !== null" class="mb-2 space-y-1">
+        <div class="flex justify-between text-[10px] text-slate-400">
+          <span>Uploading...</span>
+          <span>{{ uploadProgress }}%</span>
+        </div>
+        <div class="h-1.5 w-full overflow-hidden rounded-full bg-slate-800">
+          <div
+            class="h-full bg-accent transition-all duration-200"
+            :style="{ width: uploadProgress + '%' }"
+          ></div>
+        </div>
+      </div>
+      <p v-else-if="busy" class="text-xs text-slate-500">Loading…</p>
       <ul v-else class="space-y-0.5">
         <li
           v-for="e in entries"