The token at the end of your subscription URL works exactly like a password: whoever has it can spend your bandwidth, see every node you paid for, and on some panels read your plan and expiry date. It ends up in group-chat screenshots constantly, precisely because it does not look like a password.

Four ways it usually leaks

  1. Screenshots when asking for help. The profiles page puts the full subscription URL right in the middle of the window. Blur the token before posting, or crop down to just the error message.
  2. Online tools. Online subscription converters, YAML validators, base64 decoders — every character you paste lands on somebody else's server. For conversion there is a self-hosted alternative in converting subscription formats.
  3. Uploading the config file. Pushing config.yaml to a public repository, pasting it into Pastebin, mailing it to "support". Remember the file holds more than the subscription URL: the proxies section lists every node's address, port, UUID and password.
  4. Unprotected backups. A WebDAV backup with a weak password, or a server that only speaks plain HTTP. The setup is in WebDAV backup and sync — the parts that matter are password strength and HTTPS.

Every example link on this site is written as https://example.com/api/v1/client/subscribe?token=… for exactly this reason. Do the same when you post one.

Sponsored Where does the subscription link come from? Our partner provider gives you 1 GB of high-speed Hong Kong data at signup — import it in one click. Get high-speed nodes

If you think it is out there

A profiles page showing a subscription URL with its token and the remaining data quota
That one line is the part to blur before you post a screenshot

Find the reset subscription link button in your provider's panel and press it. The old URL dies immediately. The cost is re-importing on every device, which takes a few minutes and beats worrying about it.

If what leaked was the whole config file, resetting the subscription is not enough — the node credentials were in there too. Tell the provider what happened and let them decide whether those need rotating.

The other half: subscriptions from nowhere

The problem with "free subscriptions" and "public nodes" is not speed. It is that you have handed all of your traffic to someone you cannot identify. A proxy exit sees everything you send unencrypted and can log every domain you visit; some of them also use your device as an exit for other people.

The same logic applies one layer down: whichever DNS servers your config points at also see your full browsing history. Details in DNS settings and leak protection.

A two-minute checklist

  • Does any screenshot you posted recently contain a complete subscription URL?
  • Which online converters or formatters have you used? If any, reset the link once.
  • Has the config file ever landed somewhere public?
  • Is your backup over HTTPS, and is that password reused anywhere else?
  • Does the external controller have a secret set, and is it bound to 0.0.0.0?
  • Did the client itself come from an official source? Verification method here.

Anything on that list you cannot tick, fix it now — none of these take more than a few minutes.