Frequently Asked Questions
Everything you need to know about shadowaudit.
How does shadowaudit detect shadow API routes?▾
shadowaudit performs static analysis of your source code — no runtime probing needed. It parses framework-specific route definitions (Express routers, Rails routes.rb, Django URL patterns, FastAPI decorators, etc.) and compares them against your OpenAPI/Swagger specification. Any route that exists in code but is absent from the spec is flagged as a "shadow route" — a leading indicator of undocumented attack surface. The scanner also checks whether each route has authentication middleware applied.
Which frameworks does shadowaudit support?▾
shadowaudit currently supports 8 frameworks: Express, FastAPI, Django, Flask, NestJS, Rails, Grape, and Spring Boot. Each framework has a dedicated scanner that understands its routing patterns, middleware chains, and authentication conventions. The CLI auto-detects your framework, or you can specify it with --framework. We are actively adding more frameworks — vote for the next one on our GitLab issues.
What is the difference between the free tier and Pro tier?▾
The free tier (MIT-licensed CLI) includes full scanning for all 8 frameworks, table/JSON/SARIF output, and CI/CD integration with exit codes. The Pro tier ($19/month) adds: a web dashboard with scan history trends, ABOM PDF reports for compliance, diff reports between deploys, Slack + GitHub notifications, and priority email support. The CLI is fully functional without paying — Pro is for teams that need collaboration, reporting, and audit trails.
Is my source code sent to your servers?▾
No. shadowaudit runs locally in your environment via the CLI. It scans your code on your machine and only uploads the findings (route inventory, severity counts, file paths, line numbers) to the dashboard if you explicitly run with --cloud. The source code itself never leaves your machine. If you prefer zero cloud, use --format json and keep results locally. Your scan data is encrypted at rest (AES-256) and in transit (TLS 1.3). You can delete your data at any time.
Can I cancel my subscription at any time?▾
Yes. You can cancel anytime through Gumroad or by contacting support. Cancellation takes effect at the end of your current billing period — you retain Pro access until then. No early-termination fees. If you cancel, your scan data is retained for 90 days in case you resubscribe, then permanently deleted.
What if I lose my token?▾
If you lose your dashboard link, enter your subscription email at our recovery page and we'll send your dashboard link instantly. The email must match the one you used when subscribing. If you no longer have access to that email, contact support at ubaid0345@proton.me with proof of payment.