Security

Built to track spend, not secrets.

burnlog is designed for teams that need AI-agent cost visibility without collecting prompts, code, repo names, or paths.

Data boundary

Ingest accepts token counts, model/provider/source tags, timestamps, and opaque request ids, and nothing else — see the full field list in the privacy model. Prompt text, completions, file paths, working directories, shell output, tool output, repo names, and source code are not part of the schema.

Access controls

GitHub OAuth for browser login.
Hashed API keys; raw keys are shown only once.
Private clubs with invite codes.
Owner-only club settings, key management, reports, webhooks, and audit logs.
Admin token for lead export and manual plan changes.

Spend controls

Monthly club budgets with optional signed webhooks.
Optional hard budget guard for club API key ingest.
Per-club-key monthly caps for CI, services, and client-specific keys.
CSV reports split service usage by key label.

Audit and operations

Audit events for plan, budget/privacy/webhook, and club-key changes.
Signed budget webhooks when BURNLOG_WEBHOOK_SECRET is set.
Security headers block framing, MIME sniffing, broad referrers, and unused browser permissions.
/api/health checks database reachability for deploy monitors.
Docker compose deployment keeps Postgres private to the app network.

Responsible disclosure

Report vulnerabilities to security@sxnalabs.com. Do not open public issues for exploitable bugs. Include the affected route/package, reproduction steps, impact, and suggested fix if known.

Last updated: 2026-06-14