Security

Last updated September 23, 2026

RabbitCam is one camera, one small computer, and the phones of a few people who were invited. This page says what protects that setup, what a tester can and can't do, and what you're trusting.

The camera computer is not on the internet

The Raspberry Pi that runs RabbitCam has no public address and nothing forwarded to it from the home router. It listens only on its private Tailscale address. To the internet, the coffee-shop Wi-Fi, and anyone scanning for cameras, it doesn't exist. There is no password page to find because there is no page.

It does reach out in one way: finished animal clips are uploaded to this website's storage for the Gallery. The key it uses can write only the gallery page, its feed, and its clips, and can read or change nothing else. If the Pi is off, the Gallery keeps showing the last visits it published.

Who can reach it

Mark's own devices, and phones that Mark has explicitly shared the machine with. Mark shares exactly one machine, rabbitcam, through a link that the setup page reveals only after the family password is entered. Everyone who accepts it shows up by name in Mark's Tailscale admin, and he can remove any one person, or revoke the link for everyone, at any time. A shared phone joins nothing else. It is not on the home network and cannot see the other computers in the house.

What a shared phone can reach

A network rule on the Tailscale side limits shared users to the two ports the app uses, and nothing else on the machine.

Deliberately not reachable by testers: the video relay's own admin page, the animal-detection software's control panel, and the computer's login. Those stay available only to Mark's devices. This matters because the detection software's panel has no password of its own and the relay's page shows the camera's credentials; the network rule is what keeps both out of reach.

The access token

Every request to the service carries a long random token. Without the right one the service answers "unauthorized" and does nothing. Treat the token like a password: anyone who has it and is on the share can watch the window. It lives on the password-protected setup page, nowhere public, and is stored in the phone's Keychain. If a phone is lost, tell Mark; the token is rotated on the computer and everyone gets a new one.

What a tester can do

Watch the live view, look at the visitor list and the clips, and register their phone for alerts. That is the whole list. The service has no way to delete recordings, change camera settings, or reach anything else in the house, so a tester's phone can't either, even with the token.

Encryption

Traffic between your phone and the camera computer is encrypted end to end by Tailscale, which is built on WireGuard. Your phone and the Pi each hold a private key that never leaves the device; Tailscale passes around only the public halves and helps the two find each other. If a direct path isn't possible, encrypted packets bounce through Tailscale's relay servers, which have no key to open them.

Inside the app the server address begins with http:// rather than https://. That's honest and fine here: the encryption happens one layer down, in the tunnel, and the address only ever works from inside it.

The camera itself

The camera is on the home Wi-Fi and speaks only to the Pi. Its video password lives on the Pi and nowhere else. The camera is not shared with anyone, and its own app account is Mark's.

What you're still trusting

No system is trust-free. Here, you're trusting Tailscale to introduce devices honestly, Apple to carry push alerts and TestFlight builds, Amazon Web Services to host this site and the gallery clips, TP-Link's camera firmware, and Mark to keep the Pi updated and to share the machine only with people the family knows.

Reporting a problem

If you find a way around any of this, please say so privately before telling anyone else: markshervey@gmail.com. Include enough detail to reproduce it. You'll hear back within a couple of days.