burnlog · security
Built to track spend, not secrets.
burnlog is designed for teams that need AI-agent cost visibility without collecting prompts, code, repo names, or paths.
Data boundary
Ingest accepts token counts, model/provider/source tags, timestamps, and opaque request ids, and nothing else — see the full field list in the privacy model. Prompt text, completions, file paths, working directories, shell output, tool output, repo names, and source code are not part of the schema.
Access controls
- GitHub OAuth for browser login.
- Hashed API keys; raw keys are shown only once.
- Private clubs with invite codes.
- Owner-only club settings, key management, reports, webhooks, and audit logs.
- Admin token for lead export and manual plan changes.
Spend controls
- Monthly club budgets with warning/over notifications.
- Optional hard budget guard for club API key ingest.
- Per-club-key monthly caps for CI, services, and client-specific keys.
- CSV reports split service usage by key label.
Audit and operations
- Audit events for plan, budget/privacy/webhook, and club-key changes.
- Signed budget webhooks when
BURNLOG_WEBHOOK_SECRETis set. - Security headers block framing, MIME sniffing, broad referrers, and unused browser permissions.
/api/healthchecks database reachability for deploy monitors.- Docker compose deployment keeps Postgres private to the app network.
Responsible disclosure
Report vulnerabilities to security@sxnalabs.com. Do not open public issues for exploitable bugs. Include the affected route/package, reproduction steps, impact, and suggested fix if known.
Last updated: 2026-06-14