Your app's own events, and the leaks it gives away.

Your app as a source

Create a source of kind Your app, then send each security relevant event as it happens: login.failed, login.succeeded, mfa.disabled, role.granted, api_key.created, or password.reset, with who it was and where from. Ready-made rules turn bursts and risky changes into findings. Send your app’s events

import crypto from "node:crypto";

export async function report(event) {
  const body = JSON.stringify(event);
  const t = Math.floor(Date.now() / 1000);
  const v1 = crypto.createHmac("sha256", process.env.SOURCE_SECRET)
    .update(`${t}.${body}`).digest("hex");
  await fetch(process.env.SOURCE_URL, {
    method: "POST",
    headers: { "content-type": "application/json", "shellorbit-signature": `t=${t},v1=${v1}` },
    body,
  });
}

// await report({ type: "login.failed", actor: user.id, ip: req.ip });

JavaScript SDK

Masks keys in your logs, can block a response that carries a secret, reports your Node.js and OpenSSL versions for Incident Alerts, and on Pro and Business reports the hostnames your app and its packages call. It sends masked values, fingerprints, and hostnames, never secrets, paths, or bodies. SDK, Outbound traffic watch

import { init } from "@shellorbit/sdk";

init({ dsn: process.env.SHELLORBIT_DSN });

MCP server

Your agent reads findings and incidents and fixes your code. Read only keys look; changes need a read write key and your confirmation. MCP server

claude mcp add --transport http shellorbit https://api.shellorbit.com/mcp \
  --header "Authorization: Bearer $SHELLORBIT_API_KEY"

Log drains

Vercel, Netlify, Supabase, Cloudflare, or CloudWatch. Keys become findings; the lines are dropped. Log drains

API access

Create a key under Settings, API keys: read only to look, read write to change. Keep it on your server. API reference