Log drains
Stream your platform's logs to ShellOrbit, and keys that reach a log become findings.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
Keys leak into logs through debug prints, error dumps, and libraries that log headers. A drain streams your platform’s logs to ShellOrbit, and any key in them becomes a finding.
Set up a drain
In Leak Alarm, Log drains, add a drain for your platform. Treat its URL as a secret. Paste the drain’s secret where the table says, so requests without it are refused.
| Platform | Where to paste the URL | How the secret is checked |
|---|---|---|
| Vercel | Team settings, Log Drains, custom endpoint | Vercel signs each batch with your secret; ShellOrbit checks the signature. Put Vercel’s verification value in the drain’s verify field. |
| Netlify | Site settings, Log Drains, general HTTP endpoint | Netlify does not sign its log drains, so a Netlify drain must have a secret. Put Bearer <secret> in Netlify’s Authorization header field. |
| Supabase | Project settings, Log Drains, HTTP endpoint | An Authorization: Bearer header with your secret. |
| Cloudflare | Logpush job with an HTTP destination | Add header_Authorization=Bearer%20<secret> to the destination. |
| AWS CloudWatch | A subscription filter to an Amazon Data Firehose stream with an HTTP endpoint destination | The Firehose access key: set it to your secret. |
Any platform can also send the secret in an X-ShellOrbit-Drain-Secret header. Gzip bodies are accepted.
What happens to your logs
- Each batch is scanned on arrival and dropped. Only findings are kept: key kind, time, drain, and a masked value.
- Scanned lines and findings are never billed. Past your plan’s monthly allowance, scanning stops until the month turns, unless an owner turns on log overage.
- A tripwire key in your logs is a hit.
- On Starter and up, a match with a key fingerprinted by the SDK is reported as your real key.
Limits
| Plan | Logs scanned each month |
|---|---|
| Starter | 1 GB |
| Pro | 10 GB |
| Business | 50 GB |
Volume is counted after decompression, across all drains. An account holds 20 drains; each takes up to 600 batches a minute of up to 6 MB.
When the month’s volume is used, batches are still accepted but not scanned until the 1st, the drain shows as paused, and you get one notice. Nothing is billed for the overflow. The SDK masks keys in logs without a drain.