- Which providers do you support?
- Impact checks today: Stripe, Supabase, and OpenAI. We also detect Clerk and Resend (coverage expanding). Vercel has basic support. Logos on the page are the ecosystem we care about, not a promise that every logo has full impact detectors yet.
- What is free vs trial vs Pro?
- Free CLI (npx vasdra scan) runs locally forever with no account: provider map and a locked risk count. The 7-day trial unlocks full report evidence in the console, no card required. Pro and above add continuous watch on connected repos. Plans are gated mainly by how many repos you monitor (and seats on Team/Studio), not by how many providers the scan detects.
- What limits my plan?
- Monitored repos are the hard limit (Pro: 1, Team: 5, Studio: fair use). Seats apply on Team/Studio. Provider detection is not capped; impact depth follows our coverage (Stripe, Supabase, OpenAI today). Issue alerts use a per-repo weekly fair-use cap so noise stays manageable.
- What happens when the trial ends?
- You drop back to the free CLI automatically. Watch and full console report pause until you upgrade.
- Do I need GitHub?
- Not for a local scan. Continuous watch uses a least-privilege GitHub App on the repos you connect. GitHub is the MVP host; other VCS comes later.
- How do alerts work?
- On a paid watch plan, high-severity findings can open a GitHub issue and send email. Medium severity rolls into a weekly digest. Low severity stays in the console. You control notification settings per repo.
- Which languages and repos?
- Impact detectors target JavaScript and TypeScript today (plus SQL in migrations). Private repos and monorepos are fine. Other languages may still show up as detected providers, with impact checks arriving later.
- Will vasdra open PRs automatically?
- Only after impact quality is solid and you enable it. Findings first. Remediation PRs are opt-in.