Security

Last reviewed 2026-10-17

Sightlog is a small, independently run service. This page describes what is in place; it is not a claim of certification.

Hosting

The web app, API and PostgreSQL database run in containers on a server at Hetzner, behind a reverse proxy that terminates HTTPS with Let’s Encrypt certificates. Photos are stored in Hetzner Object Storage. Deployments are built and shipped from GitHub Actions.

Sign-in and access

Sign-in is handled by FjordID using OpenID Connect. Every API request that reads or changes your data carries a signed token that the API verifies against FjordID’s published keys. Observations can only be edited or deleted by the account that created them. The API sets standard security headers and is configured to restrict cross-origin browser access to the Sightlog site.

API keys and MCP server

You can create personal API keys from your account. A key is a random value starting with sl_; only its SHA-256 hash is stored, and the full key is shown once at creation. Presenting the key as a bearer token authenticates the same REST API the web app uses, as the account that created it. Keys have no scopes or expiry, so a key can do anything your account can, including creating more keys and deleting data. Revoke a key from the API keys page and it stops working immediately; the API records when each key was last used. Treat a key like a password.

Sightlog runs an MCP server (api.sightlog.eu/mcp, streamable HTTP; a stdio version can be run locally) that passes each call to the REST API with your key. It keeps no sessions and no credentials of its own. The AI client you connect receives whatever the tools return. We have not published a general developer API beyond this, and there is no rate limiting on the API or on keys at present.

Things to know

• Observation pages and photo files are readable by anyone with the link, the nearby feed shows your sightings only if you opt in (off by default); signed-in users then see exact coordinates and signed-out visitors see a location rounded to about 11 km (see privacy).
• Your iNaturalist access token is stored in the database; it is not separately encrypted by the application.

Certifications

Sightlog holds no security certifications (such as ISO 27001 or SOC 2).

Report a vulnerability

Email terjetyl@gmail.com with a description and steps to reproduce. Please do not access other people’s data or disrupt the service while testing. We will acknowledge reports and aim to fix confirmed issues promptly; this is a small project and we cannot promise fixed response times.