Question 1

Is my API Key safe?

Accepted Answer

Our server acts as a transparent proxy, forwarding your request to the target API without storing any request body, headers, or API Key. We recommend using a temporary key for detection.

Question 2

Why does it need a server proxy — can't it be purely client-side?

Accepted Answer

Direct client-side connections to third-party domains often hit CORS restrictions and expose keys in script-accessible context. Our same-origin proxy enables stream parsing and unified timeout control; the app layer is designed to never persist keys or request bodies.

Question 3

How reliable is the score?

Accepted Answer

The composite score aligns with Shadow API TrustScore levels (L0–L7), using black-box heuristics and protocol fingerprinting — suitable for cross-site comparison and risk flagging. A high score doesn't guarantee upstream gateway integrity; a low score may result from network or quota issues. Use multiple detections and the detailed report for judgment.

Question 4

Can I self-host?

Accepted Answer

Yes. Deploy this repository to your own Node environment and configure the environment variables. Features like the public leaderboard depend on Supabase, which is optional.

Question 5

How do I report false positives?

Accepted Answer

Please open an issue on our GitHub repository with the detection details.

Question 6

Which API protocols are supported?

Accepted Answer

The current detector targets Anthropic Messages, OpenAI Chat Completions-compatible formats, and Gemini streaming. The specific protocol is determined by the model registry's protocol field and URL heuristics.

接口配置

如何工作

大量数据采集

提取行为指纹

探测识别

公开检测榜单

为什么相信我们

常见问题

Verify What's Actually Behind Your AI API