← THE INDEX · VULN RESEARCH
Sightline
Autonomous source-to-exploit research. One rule: nothing gets reported unless a deterministic test could reproduce it.
What it is
Sightline ingests automatic license plate recognition data, normalizes and deduplicates it, maps camera networks, correlates vehicle sightings into investigation timelines, reconstructs movement, detects anomalies, and generates analyst reports.
The responsible-use position, stated first
ALPR data is privacy-sensitive. Sightline assumes the operator holds the data lawfully and is accountable for how it is used, and the design reflects that rather than treating it as a disclaimer. Role-based access control, API key auth with revocation, an immutable audit log written on every mutation, source attribution on every record, and configurable retention with scheduled enforcement are built in rather than bolted on.
A system like this is only defensible if every query is traceable to a person and every record ages out on a schedule. That constraint shaped the schema before any analysis feature existed.
Movement intelligence
The analysis layer reconstructs routes from sparse camera hits, computes travel speed between sightings, and flags impossible travel where the implied speed between two reads cannot be achieved. It also surfaces dwell time, sighting frequency, co-travel between vehicles, and camera-to-camera transition patterns.
Impossible-travel detection is the highest-value signal because it catches the two cases that matter most: a misread plate, and a cloned one. Both look identical to a naive timeline.
Evidence handling
Evidence carries a SHA-256 chain of custody and integrity is verified on download. If a report is going to be relied on, the artifacts behind it have to be provably unmodified since collection. Reports generate in several formats with key findings extracted automatically.
Stack
Python service layer with PostgreSQL, Redis and Celery for asynchronous ingest and scheduled retention, pluggable local or S3-compatible storage, and a web front end. Ingest accepts file upload, real-time stream push, a generic REST poller, and webhooks.