Questions, answered.

A security alarm for your stack. You connect the systems you already use, such as GitHub, AWS, Okta, Auth0, and your own app, and ShellOrbit tells you the moment something risky happens there, then helps you shut it down. It also watches your live site for leaked keys, your logs, tripwires you plant, and public advisories that affect what you run.

In Settings, Integrations, create a source of that kind. ShellOrbit gives you a URL and a secret, and you paste them into the vendor's own settings: an organization webhook in GitHub, an EventBridge API destination in AWS, an event hook in Okta, or a custom webhook log stream in Auth0. Each guide in the docs lists the exact screens.

No. ShellOrbit has no app to install in your accounts and never asks for broad access. Every connection is something you configure yourself: you paste our URL and secret into the vendor, or paste a scoped key or a webhook URL into ShellOrbit. You can remove any of it from the vendor's side at any time.

Ready-made rules run for every source on every plan. GitHub: a repository made public or deleted, branch protection or a ruleset removed, a deploy key added, a new organization owner, a secret scanning alert. AWS: root user activity, a console sign in without MFA, repeated failed console sign ins, CloudTrail stopped or changed, a new access key, an administrator policy attached, a security group opened to the internet, and more. Okta, Auth0, and your app: bursts of failed sign ins, MFA turned off, a new administrator, a new API token.

Yes, from Starter. A custom rule matches a header or a field in the event body (equals, not equals, contains, exists, or one of a list), optionally only when it happens more than N times in M minutes, and raises a finding at the severity you choose. Starter has 10, Pro 50, and Business unlimited.

From Starter, set how many hours of silence count as a problem on any source. If no event arrives in that time, you get one finding, for example when someone turns CloudTrail off. It resolves on its own when events resume.

A fake key, link, email address, or database row planted where your real data lives. Nobody should touch it, so a hit means something leaked. Each hit is recorded with the address and client that used it and alerts you within seconds.

On Starter, Pro, and Business you can turn on tripwire overage. You can then hold up to twice your plan's tripwires, and each one past the allowance is billed on the most you held at any point in the month and added to your next invoice. It is off by default.

On each verified domain: keys in browser code and source maps, exposed .env and .git files, open Supabase tables and Firebase rules, missing security headers, and certificate problems, including expiry and distrusted authorities. It also scans the logs you stream and watches your tripwires.

On Pro and Business, the JavaScript SDK reports the hostnames your app and its npm packages connect to. Never a path, header, or body. The first day is a baseline. After that, a host never seen before for that project becomes a finding: high when an npm package opened the connection, medium when your own code did. It is how a poisoned package calling home shows up.

No. A finding keeps the kind of key, where it was found, and a masked form such as sk_…a1b2. ShellOrbit never uses a key it finds. The SDK sends only masked values and one way fingerprints.

On Pro and Business, for accounts you connect with a scoped key: leaked keys are revoked or rotated at 8 providers, including AWS, OpenAI, Anthropic, Google Cloud and Azure, and open Supabase tables locked, each with ten minutes for you to cancel. Leaked GitHub and Hugging Face tokens are reported to their issuer. For any other app, ShellOrbit sends the finding to your own endpoint so your system rotates the key.

When a public security incident lands, such as a compromised certificate authority, a Node.js or Go security release, an end of life runtime, an actively exploited flaw, a malicious package, or a vendor breach, ShellOrbit tells you if it affects you, where, the fix, and the deadline. It never reads your code or probes your site.

No, and no service can. It sees what your sources report, what your verified domains, logs, SDK, and tripwires show, and what public feeds announce. An attacker who stays inside what looks normal, an event a vendor does not send, or a flaw nobody has announced is out of reach. Every finding comes with what to check, so your team can act.

No. Source events are included under fair use and never charged: sources keep receiving up to ten times the included volume, then new events get a 429 until the month turns so senders retry later. Findings, incident matches, tripwire hits, scans, and runtime reports are activity and never billed. The only metered charges are optional: tripwires and logs past your allowance, if you turn them on.

Yes, from Starter, along with any HTTPS URL. Findings, tripwire hits, silent sources, and incidents arrive in the channel's own format. You paste the channel's incoming webhook URL; there is nothing to install. Email alerts are on every plan.

Yes. Connect Claude, Cursor, or another agent to the MCP server to read findings and incidents and fix your code. It sees masked keys only, and changes need a read write key and your confirmation.

Only if you add one. Bring your own key for OpenAI, Anthropic, Google Gemini or Vertex AI, AWS Bedrock, Azure OpenAI, or any OpenAI-compatible provider, and ShellOrbit explains a finding or incident and the fix. It sends masked values only, never a secret, and your provider bills you.

On Amazon Web Services: DynamoDB, S3 for large source events, and Lambda. Source events are kept for your plan's history window and can carry account names and IP addresses from the systems you connect. Nothing is copied to a third party for analytics.

From the dashboard, any time. The plan runs to the end of the paid period. Payments made are not refunded, as the refund policy sets out.

99.9 percent a month on the intake endpoint, on every plan, in the terms, with a credit for any shortfall.