Skip to main content

Using the Dashboard

The dashboard at secretsbuster.com/app is where you manage domains and targets, trigger scans, and review findings without writing any code. Access requires a plan with dashboard access; sign in from secretsbuster.com/account/manage.

If you're not familiar with terms like target, domain, report, or triage, read Concepts first.

Home​

The dashboard home page (/app) is your overview. It shows:

  • Priority Actions — a filtered to-do list, ranked by severity: verified leaks awaiting review, unverifiable leaks with high confidence, other leaky reports awaiting review, targets with a scan in error state, and targets that haven't been scanned recently. You can restrict this list to a time range (last 24 hours, 7, 30, or 90 days). Each item links straight to the filtered list behind it.
  • Stats — counts of domains, targets, reports, leaky reports, and reports pending review, each linking to the relevant page.
  • Selected API key — the API key currently used when you trigger scans from the dashboard, its usage plan, usage this month, and status. If your account has more than one key (e.g. multiple subscriptions), switch which one the dashboard uses from the API Keys page.

Domains​

The Domains page (/app/domains) lists every domain your targets have been grouped under, alphabetically, with a name filter. Click a domain to see the targets that belong to it and add a new target directly to that domain.

Targets​

The Targets page (/app/targets) lists every target on your account, most recently scanned first. From here you can:

  • Add a target — enter a URL and optionally check "Scan this target now" to trigger an immediate scan (this uses your selected API key's quota).
  • Filter — by URL substring, by scan result (Leaky, Safe, Error), by scan recency (a time range, and whether to show only targets not scanned in that range), and hide targets that have never been scanned.

Each target row shows its last scan result and when it was last scanned (or "Never scanned"). Click a target to open its detail page, where you can:

  • Scan now — trigger an immediate scan against your selected API key.
  • Set a scan policy — have the target scanned automatically on a periodic basis (daily, weekly, or monthly) and/or whenever SecretsBuster's detection engine adds new secret types. See Scan Policy.
  • Browse its reports — every past scan of this target, most recent first, with its scan result and review status.

Import Targets​

Instead of adding targets one at a time, use Import (/app/import) to upload a plain-text file with one target URL per line (up to 5 MB). You can optionally trigger a scan for every imported target immediately — this counts against your quota once per target. The page shows progress while the batch is processed and lists any URLs that failed to import.

Reports​

A report page (/app/reports/{id}, reached from a target's report list) shows the full detail of one scan:

  • Timing — when it was submitted, started, and crawled (including how long it spent queued and how long crawling took).
  • Scan result and, for ERROR reports, the error detail.
  • For LEAKY reports, every secret found: which document it was found in, its type and value, how many times it occurred, whether it was validated as still active, its confidence score, and whether it's a duplicate of a secret found elsewhere. See Understanding Scan Results for how to read these.

Reviewing a report​

At the bottom of a LEAKY or ERROR report, you can review it: pick a triage category (False positive, Duplicate, or True positive), optionally leave a comment, and save. Reviewing closes the report; you can reopen it later if your assessment changes. A report that's still queued or crawling can't be reviewed yet.

Reviews​

The Reviews page (/app/reviews) lists every open (unreviewed) leaky report across your account, so you can work through your backlog without visiting each target individually. Filter by triage status (all, pending triage, false positive, true positive, duplicate), by priority bucket (verified leak, high-confidence unverifiable leak, other), and by time range. Click any report to open it and review it.

API Keys​

The API Keys page (/app/keys) lists every API key on your account: its name, usage plan, usage this month against your quota, creation date, and status. Use the radio button in the "Selected for scans" column to choose which key the dashboard uses when you trigger a scan from it — useful if your account has multiple subscriptions.

From here you can also reach your Stripe customer portal to change or cancel a plan, or subscribe to an additional plan if you need another key.