Soracin reads configuration and billing metadata from the accounts you connect. It never creates, changes or deletes anything in them. This page lists every permission, per source, and where a provider makes that promise harder to keep.
| Source | How you connect | What Soracin reads | Access class |
|---|---|---|---|
| Vercel | Vercel Integration (OAuth). Scopes, all Read: Project, Deployment, Domain, Team, Billing, Integration configuration. | Team security defaults, project protection settings, Git link, Node.js version, latest production deploy state, domains and their DNS/TLS state, billing charges (Pro/Enterprise teams). No environment variables — Vercel has no read-only scope for them, so we ask for none. | Read-only by construction |
| Supabase | Supabase OAuth app. Scopes, all Read: Organizations, Projects, Auth, Database. | Organization plan, project list, auth settings (only on/off flags and limits are kept), network restrictions, SSL enforcement, backup/PITR status, Postgres upgrade eligibility, and the security advisor's findings. Never the SQL endpoints, API keys, secrets or PostgREST config. | Read-only by construction Supabase's Database Read scope — required for SSL, backups and the security advisor — would also allow read-only SQL. Soracin's client has no SQL endpoint; layers 2 and 3 above enforce it. |
| Netlify | Personal access token you paste (ideally from a Developer or Reviewer team member, with an expiry). | GET teams, team members, sites, site certificates and plan prices — nothing else. Site
domains and HTTPS settings, whether a site is password-protected (yes/no only), build settings without
environment variables, latest production deploy state. Never environment variables, the
site password, build/deploy hooks, deploy keys or payment details. |
Not read-only by construction Netlify tokens have no scopes. Soracin only calls the read endpoints above (layers 2–3). Netlify has no usage API, so cost is your plan's list price, labelled as an estimate. |
| Cloudflare | API token you create and paste, every permission Read: Account Settings, Billing, Workers Scripts, Workers R2 Storage (account); Zone, Zone Settings, DNS (zone). | Account 2FA enforcement, zone SSL/TLS and security settings, DNSSEC status, DNS records (TXT values stored only as a hash), Worker names and settings, R2 bucket names and whether the public r2.dev URL is on, billable usage. Never Worker code, secrets or bindings, KV/D1 data or R2 objects. | Read-only by construction As long as the token is created with Read permissions only, as the card shows. |
| Neon | API key you paste — a project-scoped key (one project) or an organization key. | GET organizations, projects, branches, computes and the consumption history — nothing
else. Project settings (Postgres version, IP allow list), branch names and flags, compute autoscaling and
autosuspend, daily usage. Never connection strings, roles, passwords or data. |
Not read-only by construction Neon has no read-only key (project-scoped keys are Editor on their project). Soracin only calls the read endpoints above (layers 2–3). Costs are estimates from Neon's list prices. |
| GitHub | Soracin GitHub App you install, on the repositories you choose. Permissions, all Read: Metadata, Administration, Secret scanning alerts, Dependabot alerts; organization Administration. No token is stored — each scan uses a one-hour read-only token. | Repository visibility, default-branch protection, Actions token and approval settings, deploy keys (title and read-only flag), open secret-scanning alerts without the secret, critical and high Dependabot alerts, organization 2FA and base permission, organization billing usage. Never code, issues, pull requests, Actions secrets or logs. | Read-only by construction |
| GitLab | Access token you paste with only the read_api scope — Soracin checks the token's scopes
and refuses one that can make changes. |
Groups (2FA requirement, members and roles), projects (visibility, default-branch protection and force-push setting, merge checks, members), deploy keys (title and push access) and deploy tokens (name, scopes, expiry), top-level group compute-minute usage. Never CI/CD variables, code, job logs or runner tokens. | Read-only by construction |
| DigitalOcean | Personal access token you create with Custom Scopes, every one read: account, billing, droplet, firewall, tag, vpc, database (without credentials), spaces_key. | Team name, Droplet names, sizes, backups and whether they have a public IP, firewall rules, managed database engines and trusted sources, Spaces key names and bucket grants, month-to-date usage. Never database connection details or passwords, Kubernetes credentials or Spaces secrets. | Read-only by construction As long as the token is created with read scopes only, as the card shows. |
| Railway | Workspace token you paste. | Projects and environments, project members and roles, each service's region, replicas, restart policy, health check, latest deployment status, domains (and whether their DNS is valid) and public TCP proxies. Never variables, logs or volume contents. | Not read-only by construction Railway tokens have no scopes. Soracin only sends a fixed set of read queries (layers 2–3). No usage cost yet. |
| OpenAI | Admin API key you paste (Indie and Pro). | GET /v1/organization/costs and GET /v1/organization/projects — nothing
else. Never prompts, completions or files. |
Not read-only by construction OpenAI offers no read-only key for costs; admin keys can also manage your organization. Soracin only calls the two endpoints above (layers 2–3). |
| ChatGPT | None. ChatGPT has no usage or billing API, so you type in your plan, seats and price. | Nothing — Soracin never connects to ChatGPT. The line shows as "manual" in your cost view. | No access at all |
| AWS | A CloudFormation stack in your account creates an IAM role Soracin assumes with an ExternalId that Soracin generates for you. | AWS-managed SecurityAudit + ViewOnlyAccess, with 52 explicit denies on
actions that could return data, plus read on the stack's own cost-export bucket. The role checks its
own permissions daily and the source card flags anything extra. |
Read-only by construction Nothing stored but the role ARN. |
Configuration passes through an allowlist before it's stored: only fields we've named
survive, and anything that still looks like a credential is replaced with [REDACTED].
| Plan | Findings, changes & snapshots | Cost records |
|---|---|---|
| Free | 7 days | 30 days |
| Indie | 90 days | 13 months |
| Pro | 1 year | 25 months |
Slack, Discord and webhook URLs are stored encrypted; the dashboard only shows the host and last four characters. Before every delivery Soracin resolves the host and refuses private, loopback, link-local and cloud-metadata addresses, connects only to the address it checked, and never follows redirects.
Webhooks carry X-Soracin-Signature: t=<unix seconds>,v1=<hex>, where
v1 is HMAC-SHA256 of <t>.<raw body> keyed with the channel's signing
secret (shown once, when you add the channel). Reject requests whose t is more than a few minutes old.
| Provider | Purpose | Data |
|---|---|---|
| Amazon Web Services (us-east-1) | Hosting, database, encryption keys (KMS), sign-in (Cognito) | Everything Soracin stores |
| Cloudflare | Hosting for this site and the dashboard, DNS | Request metadata |
| Resend | Email delivery | Your email address and alert contents |
| Creem | Payments and subscriptions | Billing details (Soracin never sees card numbers) |
No LLM provider processes your data today: alert explanations are templated. If that changes, the provider will be listed here before it's used, and only redacted configuration metadata will be sent.
Email support@soracin.com with “security” in the subject.