On this page
When a subscription address appears in a group chat, screenshot, or conversion website, the risk goes beyond someone seeing a web address: the full link may let them keep downloading your configuration. Identify whether the link, node credentials, or website account was exposed, invalidate the old values separately, then check the copies on every device and in backups.
After a Subscription Leak, Invalidate the Old Link
Find the reset or revocation control in your subscription provider’s panel and invalidate the token in the old URL. If there is no self-service option, contact the provider. Deleting the public message cannot retrieve copies someone has already saved; check the node credentials in those copies separately as described in the next section.
Verify through the service panel or a local environment you control: the old address should report that it is invalid or stop returning the original configuration. If it can still download the full content, revocation is incomplete. Do not submit the old link again to search engines, unfamiliar conversion services, or public support tickets.
If you also published the complete YAML, its UUID, password, or private key may still work. Replacing the subscription token does not invalidate the old node credentials. The website account password and Dashboard secret also need to be handled separately.
How to Handle Exposed Configurations, Website Accounts, and Controller Credentials
A subscription token controls whether someone can obtain the configuration. UUID values, passwords, private keys, and other authentication fields inside nodes control whether someone can connect to the server. If the public content includes the latter, an attacker may keep using old nodes without the new subscription until the provider rotates or invalidates those node credentials.
Users usually cannot rotate server-side node credentials themselves. Tell the provider the exposure time and configuration type, and ask whether old nodes will be replaced and whether unusual devices or traffic can be reviewed. Do not resend the raw YAML as proof; provide only redacted node names, protocol types, and the necessary times.
Exposed content and response scope
| Exposed content | What someone else may obtain | Required response |
|---|---|---|
| Complete subscription URL | Continue downloading or updating your configuration | Reset/revoke the subscription link and update every client |
| Raw YAML or QR code | Existing node credentials in the file | Ask the provider whether node credentials must be rotated |
| Service-site account | Plan, device, payment, or subscription-management permissions | Change the password, sign out other sessions, and enable available two-factor authentication |
| external-controller secret | Control Mihomo when its port is reachable | Rotate the secret and tighten listener and firewall restrictions |
Replace Old Subscriptions on Computers, Phones, and Routers
The service panel may call the action “Reset subscription,” “Update subscription address,” or “Revoke link.” After completing it, store the new link in a password manager. The old address should return 401, 403, 404, an invalid-link message, or stop returning the original configuration. During verification, check only the status and whether a configuration is still returned; do not write the response content to public logs.
Delete the old subscription entry on your main device, add the new address, and update it manually. Once the update time refreshes and the policy groups and node list load correctly, make it the active configuration. Confirm that this device can update with the new link, then replace the old address on other computers, phones, routers, and WebDAV-synced copies one by one. Updating only one device leaves scheduled tasks on another device requesting the old token.
OpenClash on a router, a server cron job, or a container environment is easy to miss. Review scheduled subscription-update logs and confirm that the old URL no longer produces repeated 401/403 entries. If devices request the invalid link every hour, another configuration still needs cleanup.
Evidence that replacement is complete
- Every active device updates with the new link
- The old link no longer returns the original configuration
- The service panel shows no unrecognized device or unusual traffic
- Scheduled-task logs no longer request the old token
- Sync and backups do not restore the old address
Remove Forgotten Copies from Chats, Repositories, Logs, and Sync Storage
Record when and where the leak occurred and what was exposed, without forwarding the complete link again. Remove posts, support-ticket attachments, screenshots, and code snippets to reduce further spread.
Reconstruct your troubleshooting path. Did you include a curl command in a terminal screenshot, or put the URL in a Git repository, chat history, cloud note, browser bookmark, CI variable, or online YAML checker? Query parameters containing a token may also enter Web server access logs and Shell history.
Removing these copies does not make the old token safe again; it prevents accidental reuse by new members and prolonged exposure in search engines or collaboration tools. If the content was committed to Git, rotate or revoke the credentials first. Changing the latest file does not remove them from history. Decide whether to clean history according to the repository’s procedures and the information exposed; rewriting history never replaces revocation.
Locations often overlooked
- Group chats, forums, and customer-support ticket attachments
- Address bars, QR codes, and terminal commands in screenshots
- Git commit, Issue, CI logs, and environment variables
- Shell history, clipboard sync, and cloud notes
- Online subscription conversion, YAML validation, or benchmark pages
- Backups from old phones, old computers, and uninstalled clients
What Information Can Subscription Conversion Sites Access?
A conversion site must first read your subscription URL and usually download the complete configuration before producing another format. The operator can therefore see the token, node addresses, and node credentials. HTTPS protects data in transit only; it does not guarantee that the site will not log, cache, or reuse that content.
If the client can import directly, conversion is unnecessary. When formats genuinely differ, prefer the conversion entry provided by the subscription provider or run a reviewable local tool on a device you control. Even then, confirm whether the output link is publicly guessable, whether the service retains history, and whether the old token can be reset at any time.
How to choose when conversion is required
| Method | Risk assessment | Recommendation |
|---|---|---|
| Direct client import | The raw URL is given only to a client you use | Preferred |
| Provider's official converter | The provider already holds the subscription, but you must still inspect output-link and retention rules | Use after reviewing the terms |
| Self-hosted conversion tool | Data stays in an environment you control, but you are responsible for updates and access control | Suitable for users who can maintain the service |
| A free conversion page found through search | The operator, logging, and retention period are unknown | Do not submit the raw link |
How to Redact Support Tickets, Logs, and Screenshots
When a subscription update fails, you usually need to provide only the client and core versions, HTTP status code, Content-Type, original error text, and time. For the URL, keep the domain and path type but hide the token, query parameters, username, password, and node address. For a YAML error, show only the surrounding structure and replace real values with example.com and REDACTED.
Logs may also contain Authorization, UUID, Dashboard secret, and internal addresses. Read the redacted version again; do not cover only the browser address bar. A QR code or terminal history can expose the same link again.
Do not leave another complete token in terminal commands, screenshots, or the browser address bar, and do not paste the exposed URL into an online YAML checker.
客户端：Clash Verge Rev x.y.z
内核：Mihomo x.y.z
订阅域名：example.com
token：REDACTED
HTTP 状态：403
错误：subscription update failed at 10:32Storing Subscriptions, Backing Up Configurations, and Moving to a New Device
- Storage
- Save the raw link in a password manager, encrypt configuration backups, and do not put a token in the filename.
- Sync
- Use separate credentials and least privilege for WebDAV, cloud storage, and CI, and verify the sharing scope.
- Screenshots
- Crop the address bar, QR code, and configuration details before uploading to a ticket.
- Logs
- Enable URL redaction if the client supports it. Before publishing, search for fields such as token=, Authorization, password, and uuid, and manually check screenshots and QR codes.
- Departure or device replacement
- Remove authorization for old devices and clean local configurations. Reset the subscription if you cannot account for every copy.
The incident is truly over only when the old subscription no longer works, necessary node credentials have been rotated, every legitimate device uses the new link, and old values no longer appear in public locations or automated tasks. “The post was deleted” alone is not completion.