Tripwires
Fake keys, links, emails, and database rows that tell you the moment something leaked.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
A tripwire is a fake secret planted where your real data lives. Nobody has a reason to touch it, so its first use means something leaked: a dumped table, a copied config, a public repo, an over-curious AI agent.
Kinds
| Kind | Plant it in | It trips when |
|---|---|---|
| Link | A document, config file, or internal page | Someone opens the link |
| Email address | A users table or mailing list export | Someone sends mail to it |
| Database row | Your users table, as a fake user with a tripwire email and link | Someone emails the address or opens the link |
| Fake AWS key | A .env file, CI settings, a secrets folder | A call to its ShellOrbit endpoint, or the key appearing in your log drains or on your site |
Fake AWS keys
ShellOrbit generates a key that looks real (AKIA… and a 40 character secret) but no AWS account knows, so it can never touch anything. Paste the snippet from the dashboard:
AWS_ACCESS_KEY_ID=AKIA…
AWS_SECRET_ACCESS_KEY=…
AWS_REGION=us-east-1
AWS_ENDPOINT_URL=https://…/k/…| Catches | Misses |
|---|---|
The whole file used: AWS SDKs and the CLI call AWS_ENDPOINT_URL, so the call reaches ShellOrbit with the source address and user agent | Only the two values copied and used against AWS directly: AWS rejects the key and tells no one |
| The key ID found in your log drains or on a page of a verified domain | A leak nobody acts on that never appears where ShellOrbit looks |
The key the SDK plants with tripwire: true |
A hit is a strong signal; silence is not proof of safety. Pair tripwires with scans and log drains.
Hits
A hit records the time, the tripwire, what was touched, and the source address and user agent. It alerts within seconds, then stays quiet for 15 minutes for that tripwire. A hit is activity, never billed.
| Plan | Tripwires | Beyond the allowance, optional |
|---|---|---|
| Starter | 15, fake AWS keys included | Up to 30 |
| Pro | 50 | Up to 100 |
| Business | 200 | Up to 400 |
Tripwire overage
Owners and admins can turn on tripwire overage next to log overage, on Starter, Pro, and Business. While it is on, you can hold up to twice your plan’s tripwires. Each tripwire past the allowance is billed once after the month closes, as one line on your next invoice, on the most you held at any point in the month, so creating and deleting tripwires before the month ends does not change the bill. It is off by default. Turn it off and no tripwire can be created past the allowance; that month is still billed on its peak.
Rules
Plant tripwires only in systems you own or are authorised to protect. A tripwire records a request and alerts you; it runs nothing on the visitor’s machine. Do not use them to track people, for example in customer emails.