📘 Documentation
Permissions & data
CobwebCheck is read-only everywhere. We never delete, change, or create anything in your accounts. Costs are real only: if a provider has no billing API or isn't connected, the report says “cost not connected” — never an estimate.
What each connector requests
| Connector | How you connect | What it requests | Cost data |
|---|---|---|---|
| GitHub | GitHub App install | Metadata: read and Contents: read. No webhooks, no write access. Reads repo names, activity dates and a short list of named config/dependency files (package.json, wrangler.toml, Dockerfile, README…). Never your real .env files. | Detects services (no cost) |
| Vercel | Integration (OAuth) | Read-only: projects, deployments, domains; billing charges (Billing: Read) on Pro/Enterprise teams. | Real on Pro teams; plan only on Hobby |
| Stripe (your revenue) | Stripe App (OAuth) | charge_read, invoice_read, subscription_read, product_read, plan_read, webhook_read. GET requests only. Connect several accounts, one after another. | Real revenue per project |
| Cloudflare | Custom API token | Account › Billing › Read and Account › Account Settings › Read. Nothing else. | Real: plan prices + what Cloudflare charged in the last 30 days |
| DigitalOcean | Personal access token | Custom scopes, read only: account, billing, droplet, project. | Real |
| Vultr | API key | Vultr keys are full access by design; we only call GET endpoints. You can restrict the key by IP. | Real |
| Linode / Akamai | Personal access token | Account: Read Only, Linodes: Read Only, everything else No Access. | Real |
| Scaleway | API key | BillingReadOnly + ProjectReadOnly policies. | Real |
| AWS | IAM access key | Only ce:GetCostAndUsage. AWS charges $0.01 per Cost Explorer request; each scan makes one. | Real |
| OpenAI / Anthropic | Admin key | Read organization usage and costs. | Real |
| Supabase | Access token | Supabase tokens can't be scoped; we only call GET endpoints. | Plan tier (free plan = confirmed $0) |
| Hetzner Cloud | API token (Read) | Read. | No billing API: servers listed, cost shows “not connected” |
| Kamatera | API key | Full access by design; we only call GET /service/servers and GET /service/server/{id}. | No billing API |
| MacStadium | Portal token | Can't be read-only; we only call GET /core/api/servers, never power actions. | No billing API |
| Resend | API key | Full access is required to list domains; we only list domains. | Inventory only |
| Plausible / PostHog | API key | Plausible Stats key; PostHog personal key with query:read + project:read. | Page views only |
| Bank / card statement | CSV upload | — | Only recurring tech charges are kept; raw rows are never stored |
What we store
- Connector keys/tokens: encrypted (AES-GCM, bound to your account), never shown again, deleted when you remove the connection.
- GitHub and Google sign-in tokens: stored encrypted only so we can revoke them when you disconnect or delete your account.
- Vercel token: used once when you connect; not stored.
- Repo access: short-lived GitHub App installation tokens created per scan. Your source code is never stored.
- Scan cache: per repo, only the names of detected services and the file paths they were found in — no file contents.
- Weekly digest (paid, on by default): an email only when something changed; one-click unsubscribe in every email or in Settings.
- AI discovery: a capped read of named config files by an AI model running on Cloudflare (max $0.05 per scan, paid by us); results cached by commit.
Retention
- Reports: 30 days. AI discovery cache: 30 days. Per-repo scan cache: 30 days.
- Monthly cost snapshots for paid tracking (real charges per app and service): about 13 months.
- Sessions: 14 days. Error log (scrubbed of tokens and emails): 30 days.
- Your choices on findings, connections and keys: until you remove them or delete your account.
Disconnect or delete
- Settings → Connected accounts: remove any account; its key is deleted immediately.
- Disconnect GitHub uninstalls the CobwebCheck GitHub App and revokes its authorization.
- Stripe: disconnect in CobwebCheck, then also uninstall under Stripe Dashboard → Settings → Installed apps. Vercel: also remove under Vercel → Integrations.
- Delete account (Settings → Data & privacy) removes everything we store, uninstalls the GitHub App, revokes GitHub/Google grants and bank connections, and cancels any subscription.
Supported providers
GitHub, Vercel, Stripe, Cloudflare, DigitalOcean, Vultr, Linode/Akamai, Scaleway, AWS, OpenAI, Anthropic, Supabase, Hetzner Cloud, Kamatera, MacStadium, Resend, Plausible, PostHog, and bank/card statements (CSV). Detected in repos (connect or upload a statement for cost): Netlify, Railway, Render, Fly.io, Heroku, Google Cloud, Firebase, Sentry, Clerk, Twilio, SendGrid, Postmark, ElevenLabs, OpenRouter, Pinecone, Upstash, Neon, PlanetScale, MongoDB, Cloudflare R2, Tailscale and more.
See a sample report · Privacy policy · Questions: [email protected]