Domain scans
What Leak Alarm checks on your live site, how often, and what it never does.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
A scan reads your verified domain the way a visitor’s browser does. Every plan scans daily. Start one from the dashboard up to three times an hour per domain.
What it finds
| Check | Example |
|---|---|
| Keys in code sent to browsers, including scripts and source maps | Live Stripe, OpenAI, Anthropic, AWS, GitHub, and Supabase secret keys, database URLs with a password; 39 kinds in all |
| Exposed files | .env, .git/config, published source maps |
| Open Supabase tables | Readable with your public key |
| Open Firebase rules | Data readable without signing in |
| Missing security headers | Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options |
| HTTPS certificate expiry | Critical once expired, high within 14 days, medium within 30 days |
What it records for Incident Alerts
| Item | From |
|---|---|
| Certificate chain | The TLS handshake. A chain through a distrusted authority becomes a critical incident |
| Server software and version | Server, X-Powered-By, X-Generator, X-Runtime, X-AspNet-Version, such as nginx/1.18.0. Hidden versions record the product only |
| Platform | Vercel, Netlify, Cloudflare from response headers; Supabase, Firebase from the site’s own code |
Findings
Each finding has the kind of problem, where it was found, a masked value such as sk_…a1b2, the severity, and the fix, in plain words and as a prompt for Lovable, Cursor, or Bolt. New findings are activity, never billed.
New critical and high findings alert at once, at most once an hour per domain (see alerts). A fake key from one of your tripwires found on the site is a tripwire hit instead. On Pro and Business, keys can be revoked.
What a scan never does
- Use a key it finds, or store one in full.
- Copy rows from an open table; it records only the table name.
- Scan a domain that is not verified, or fetch anything a browser would not.
- Send anything on the TLS connection it opens to read the certificate chain.
- Send exploit payloads, guess passwords, or probe for flaws. Version headers are read, never tested.