Many people forward a subscription URL like an ordinary link. It is closer to an account password — and the consequences of a leak go beyond someone using your bandwidth.
What the URL contains
https://provider.example/api/v1/client/subscribe?token=UNIQUE_IDENTIFIER
The token is your credential.Whoever holds it can:
- Use all your servers and consume your quota.
- See your plan details — many providers return remaining traffic and expiry in the response headers.
- Infer your usage — the server list reveals which tier you bought.
- Keep doing so indefinitely, until you reset it.
The four common leak paths
| Situation | Risk | Avoid it by |
|---|---|---|
| Screenshots when asking for help | The full URL is visible | Switch tabs first, or redact the column |
| Online subscription converters | You hand the URL to a third party | Self-host an open-source converter, or reset afterwards |
| Committing a config to Git | It stays in history permanently | Add config files to .gitignore |
| Logging into the dashboard on a shared PC | Browser retains the URL | Clear browsing data afterwards |
What a single server link exposes
The additional risk with server links is exposing the server address. Widely circulated addresses attract targeted blocking, which is why many providers forbid sharing individual servers.
What your provider can see
Frequently overlooked: there are technical limits on what a provider can observe.
| They can see | They cannot see |
|---|---|
| Which hostnames you connect to (SNI is visible) | The contents of HTTPS pages |
| Traffic volume and timing patterns | Passwords you type, messages you send |
| Your real IP address | Contents of end-to-end encrypted apps |
| Which servers you use |
In other words: HTTPS protects the content, but does not hide who you talked to. That is inherent to any proxy arrangement, not a defect of one provider.
A self-audit list
- Does the subscription URL appear in any chat history, email, Git repo or cloud note?
- Have you used an online converter? If so, have you reset the URL since?
- Do your screenshots redact the subscription column and server labels?
- Have you configured it on a shared or borrowed device? Did you clean up?
- Is the master password on the password manager holding it strong enough?
If any answer is uncertain, the simplest remedy is to reset the subscription URL and re-enter it on your own devices. It costs a few minutes and invalidates every past leak at once.