Email addresses
Addresses are extracted from the rendered page: the visible text,mailto: links, and inline script data. They are lower-cased and de-duplicated. Every plan sees the full list on an app page and in the API, and the email: filter is available to everyone.
An address on a page is not proof of anything beyond its presence there. Contact addresses, marketing footers, and example data all appear.
Credentials
After the page is rendered, its source is scanned for strings that match the shape of an API key, token, or secret: cloud provider keys, payment and messaging service tokens, database URIs, and hundreds of other formats. Each match is a finding with the name of the detector that matched it. A finding is verified when the scanner was able to confirm it with its issuer at snapshot time, for example by making an authenticated call that succeeded. Unverified findings are kept too; they may be revoked, malformed, or placeholders, and the format alone is no guarantee. Verification happened at snapshot time. A verified credential may have been revoked since; an unverified one may never have been valid.What each plan sees
On the Free plan an app page shows the detector names with a lock in place of the raw strings. The API, available on Plus and Pro, includes the
credentials array whenever there are findings.