How CobwebCheck works
CobwebCheck connects to the services where your side projects live, lists every project with its activity, cost and domain renewal date, and gives each one a keep, kill or sell verdict. Access is always read-only. CobwebCheck never deletes, pauses or changes anything.
Getting started
- Open cobwebcheck.com/app and choose a service to connect.
- Approve access on that service's own consent screen. You never paste a key.
- CobwebCheck reads your project list once, builds your report, and shows a card for each project.
Want to see it first? The demo report uses example data.
What each connection reads
| Service | How you connect | What we read | What we never do |
|---|---|---|---|
| GitHub | GitHub App, and you choose the repos | Repository metadata (name, last push or activity date, stars), plus only these named dependency/config files to detect which services a project uses: package.json, requirements.txt, pyproject.toml, go.mod, Gemfile, .env.example, .env.sample, vercel.json, fly.toml, render.yaml, railway.json, railway.toml, wrangler.toml, wrangler.json, wrangler.jsonc, Dockerfile, docker-compose.yml, firebase.json, serverless.yml, supabase/config.toml, prisma/schema.prisma, README.md, Procfile, Makefile, deploy.sh, scripts/deploy.sh, compose.yaml, docker-compose.yaml, fastlane/Fastfile, fastlane/Appfile, ExportOptions.plist, ios/ExportOptions.plist, Podfile, ios/Podfile, codemagic.yaml, bitrise.yml, main.tf, terraform/main.tf, infra/main.tf, ansible.cfg, inventory, inventory.ini, hosts, playbook.yml, ansible/inventory, ansible/hosts, server.properties, server.cfg, Game.ini, ServerSettings.ini, .github/workflows/*.yml (workflow files only), *.tf files in the repo root. Permissions: Metadata: read-only, Contents: read-only. | Read any other file (your source code, real .env files), write, or open issues/PRs |
| Vercel | Vercel Integration | Projects, deployments, domains and, for Pro/Enterprise teams, real billing charges (Billing: Read) | Create, change, or delete projects, deployments, domains or env vars |
| Domains | No connection needed | Public expiry dates from RDAP (public domain registration records) | Access your registrar account |
| Railway, Cloudflare, Stripe | One-click OAuth (planned) | Usage and projected bill, domain renewals, and whether a project earns revenue | Make changes or move money |
| OpenAI / Anthropic | Optional admin key (planned) | Usage and cost. Without a key we show an estimate and label it clearly. | Use your key for anything other than reading cost data |
Tokens
The access token from each connection is used during that connection to read your project list. It is not stored afterward. Only read (GET) requests are made to your accounts.
Verdicts
- Keep: recently active, or it's earning money.
- Kill: no activity in a long time, and it still costs money.
- Sell: idle, but it has a live site, domain or audience that someone else might want.
Verdicts are only suggestions. You take any action yourself, in your own accounts.
Optional: real AI spend (OpenAI / Anthropic)
OpenAI and Anthropic have no one-click read-only connection. If a project uses them, its card shows Key needed for real cost. You can add an Admin key (OpenAI Admin keys, Anthropic Admin keys); we check it with one read-only call, store it encrypted, never display it, and only read cost reports and project/workspace names. Costs are matched to a project when the OpenAI project or Anthropic workspace has the same name as the repo or Vercel project; otherwise they show as account-level spend. Remove the key anytime in the app. Without a key, AI spend is not counted and never estimated.
Verdicts
Kill means money is confirmed leaking (real billed charges, or a still-registered domain). Dormant means idle with $0 cost that we can see. Sell means idle but with a live site and some traction. Keep means active.
Optional: real costs from a bank or card statement
Many side-project costs (VPS, Mac hosts, game servers, domains, app store fees) never show up in GitHub or Vercel. Download a CSV from your bank or card (Chase, Amex, Capital One, Wells Fargo, Apple Card, or most others with date, description and amount columns) and upload it in the app. CobwebCheck finds recurring charges, keeps only tech ones (from a curated list of hosting, VPS, Mac and game hosts, registrars, app stores, AI and SaaS vendors) and discards everything else without storing it.
- Charges are matched to a project using repo signals (for example “Hetzner” in a README), project names and domains, domain renewal dates for registrar charges, and app store fees to your iOS project.
- Anything we can't match goes into Untracked tech spend. Assign it to a project once and we remember that merchant. Unsure merchants sit in a collapsed Maybe tech? list; hide any forever.
- Costs from your statement are real charges, so they count toward verdicts. Nothing is estimated.
- Delete all bank data removes every stored charge and choice immediately.
Optional: revenue from your Stripe (read-only)
Connect your Stripe account with one click (the CobwebCheck Stripe App asks only for read permissions). We match payments to projects by product metadata (project=<repo name> or a URL/domain), product names, statement descriptors and webhook endpoint URLs on a project's domain. Cards show real revenue (90-day average), active subscriptions and last payment. Projects that earn money are marked Keep; idle projects with past paying customers or traffic may be marked Sell.
Page views
Each card shows page views for the last 30 days and the trend versus the 30 days before. Sources: Vercel Web Analytics (automatic with the Vercel connection), Plausible or PostHog (optional read key). We also detect analytics libraries in your repo (Vercel Analytics, Plausible, PostHog, Google Analytics, Cloudflare Web Analytics, Umami, Fathom). If nothing is found the card says “No analytics detected.” Google Analytics and Cloudflare one-click connections are coming.
All known assets
Every card has an All known assets list: repo, Vercel project and latest deployment, domains (expiry and registrar), detected services, servers and Mac hosts, AI spend from your keys, bank charges, Stripe products and analytics, each with where we found it and a link.
Plans
The free scan shows your top 3 leaks. The full report is $5/month or $48/year, paid through Stripe Checkout; manage or cancel anytime from Manage billing.
How to disconnect
- GitHub: Settings → Applications → Installed GitHub Apps → CobwebCheck → Uninstall (or Configure to change repo access).
- Vercel: Dashboard → Integrations → CobwebCheck → Manage → Remove.
- API keys: CobwebCheck app → Optional: real AI spend → Remove key. Also revoke the key at OpenAI/Anthropic.
- Stripe: CobwebCheck app → Disconnect & delete, then Stripe Dashboard → Settings → Installed apps → CobwebCheck → Uninstall.
- Page-view keys: CobwebCheck app → Optional: page views → Remove key.
- Bank/card data: CobwebCheck app → Delete all bank data (beta bank connections: Disconnect & delete).
- Your data: email [email protected] to have your report data deleted.
Support
Questions or problems: [email protected].