Documentation
How to connect sources and what their rules detect, how Leak Alarm finds leaked keys and watches tripwires, how Incident Alerts matches public advisories to your stack, and how to respond to a finding.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
| Start here | Read |
|---|---|
| Connect your first system | Quickstart, then the guide for GitHub, AWS, Okta, Auth0, or your app |
| Know what is detected | Rules and silent sources |
| Find leaked keys | Verified domains, then site checks and tripwires |
| Hear about public incidents | Incident Alerts |
| Act on a finding | Findings, alerts, and revoke |
| Build on ShellOrbit | HTTP API, SDK, and MCP server |
Every connection is something you configure yourself, in Settings, Integrations: there is no app to install in your accounts and no vendor sign-in.
Get started
Quickstart
Connect your first source, send a test event, and see the finding it raises.
Sources
Sources
What a source is, the URL and secret it gives you, how its events are checked and kept, and the limits by plan.
Connect GitHub
Send a GitHub organization's repository, protection, deploy key, membership, and secret scanning events to a source.
Connect AWS
Send CloudTrail management events and console sign ins to a source with an EventBridge rule and API destination.
Connect Okta
Send an Okta org's sign in, MFA, privilege, and API token events to a source with an event hook.
Connect Auth0
Send an Auth0 tenant's log stream to a source with a custom webhook.
Send your app's events
Report your own sign in, MFA, role, and API key events to a source, in one small signed JSON format.
Custom sources
Connect anything that sends signed JSON webhooks, such as Stripe, Shopify, Paddle, Clerk, or Resend, and watch it with your own rules.
Signature verification
How each source proves its events are genuine, and what happens when a signature does not check out.
Detection
Rules
The ready-made rules every source gets, and how to write your own: match a field, or count it over a window.
Silent sources
Hear when a source stops sending, for example because someone turned CloudTrail off.
Verified domains
Prove you control a hostname once, then ShellOrbit checks it for leaked keys, exposed files, and certificate problems.
Domain scans
What Leak Alarm checks on your live site, how often, and what it never does.
Tripwires
Fake keys, links, emails, and database rows that tell you the moment something leaked.
Log drains
Stream your platform's logs to ShellOrbit, and keys that reach a log become findings.
JavaScript SDK and DSN
Mask keys in your logs before they are written, flag responses that carry a secret, and report your runtime and the hosts your app calls.
Outbound traffic watch
The SDK reports the hostnames your app and its npm packages connect to, and a host never seen before becomes a finding.
Incident Alerts
Know quickly when a public security incident affects your stack: where, the fix, and the deadline.
Respond
Findings
One feed for everything ShellOrbit raises: what a finding holds, how to acknowledge and resolve it, and how long it is kept.
Alerts and usage warnings
Hear about findings, tripwire hits, silent sources, and incidents by email, Slack, Discord, Teams, or any URL, and about your week every Monday.
Revoke and undo
Shut a leaked key at its provider, with ten minutes for you to cancel, or send it to your own system to rotate.
Revoke in your own system
Send leaked keys from any app to your own endpoint, signed, so your system rotates them. ShellOrbit never sends the key.
AI explanations
Bring your own AI provider key, and get any incident or finding explained with the fix for your setup.
Developers
MCP server
Let Claude, Cursor, and other AI agents read findings, incidents, and source events, and fix what they find in your code.
HTTP API
Manage sources and rules, read source events and findings, and drive Leak Alarm from your own code.
Status codes and troubleshooting
What each failure means, which side it comes from, and the first thing to check.
Account
Team, seats, sign-ins, and the audit log
Who can do what in an organization, how seats are counted and charged, and what the audit log and sign-in history record.
Limits, fair use, and overage
What each plan includes, what happens past it, the optional tripwire and log overage, and the technical limits that apply to every plan.