FAQ

How do I get started?

Verify your email at secretsbuster.com/account/subscribe, pick a plan, and follow the confirmation email to retrieve your API key and (if your plan includes it) dashboard access. See Getting Started for the full walkthrough.

Is there a free plan or free trial?

There's no permanently free plan, but some plans include a free trial period, and there's an affordable entry-level plan for individuals and small teams. Payment is handled entirely by Stripe. For occasional one-off checks without an account, use the free scanner on the homepage — note it only scans the submitted URL and its associated resources, and is meant for demonstration purposes.

Can I change my plan later?

Yes — upgrade or downgrade at any time from Account Management via the Stripe customer portal. Changes take effect at the start of your next billing cycle; upgrading gives you the new scan capacity immediately.

What happens if I exceed my monthly scan limit?

Creating new reports (POST /reports) will return 403 Forbidden until your quota resets at the start of the next billing period, or you upgrade to a higher-tier plan for immediate additional capacity. Check remaining quota any time via GET /accounts/me or the API Keys dashboard page.

Does every API call use up my quota?

No. Only POST /reports (creating a scan) consumes quota. Listing reports, reading a report, reviewing a report, and checking your account status are all free to call as often as you need.

How do I sign in without a password?

SecretsBuster dashboard access is passwordless. Go to secretsbuster.com/account/manage, enter your email, and follow the link you receive — it signs you in and gives you access to your dashboard and subscription management.

I lost my API key — can I get it back?

Yes, sign in via Account Management and open the API Keys page to see your key(s) and their status.

Can I have more than one API key?

Yes, an account can hold multiple API keys (e.g. one per subscription or per team). Pick which one the dashboard uses when triggering scans from the API Keys page.

I think a finding is a false positive — what do you do with that feedback?

Contact us with the details. Reports of false positives directly help improve detection accuracy for everyone.

Where can I find the full API schema?

The interactive reference is at secretsbuster.com/doc/api, backed by the OpenAPI 3.1 specification. See also Using the API for a guided walkthrough.