Connects to what you already run. You set it up.
Sources for GitHub, AWS, Okta, Auth0, your own app, and any signed webhook; alerts to email, Slack, Discord, Teams, or any URL; revoke and rotate at 8 providers. Every connection is a URL, a secret, or a scoped key you paste in yourself, in Settings, Integrations.
Sources
GitHub, AWS, Okta, Auth0
Each sends its own events to a ShellOrbit URL, signed with a secret you share.
Learn more →Your app
Your own events
Sign ins, MFA changes, new admins, and API keys, in one small JSON format.
Learn more →Alerts
Email, Slack, Discord, Teams
Paste a channel's incoming webhook URL. Nothing to install.
Learn more →Respond
Revoke and rotate
A scoped key per provider, so a leaked key can be shut off with time to cancel.
Learn more →Sources
Create a source in Settings, Integrations, choose its kind, and paste the URL and secret ShellOrbit shows into the vendor. Ready-made rules start working on the first event.
| Source | What it sends | Guide |
|---|---|---|
| GitHub organization | Repository, branch protection, ruleset, deploy key, membership, and secret scanning events | Connect GitHub |
| AWS | CloudTrail management events and console sign ins, through EventBridge | Connect AWS |
| Okta | Sign in, MFA, privilege, and API token events | Connect Okta |
| Auth0 | The tenant’s log stream: failed and successful sign ins, and account changes | Connect Auth0 |
| Your app | Your own sign in, MFA, role, and API key events | Send your app’s events |
| Anything else | Any webhook signed as Stripe, Shopify, Paddle, GitHub, Standard Webhooks (Clerk, Resend, and other Svix senders), or ShellOrbit | Custom sources |
Leak Alarm connections
- Your site: verify a domain with one DNS record for site checks. Verified domains
- Log platforms: Vercel, Netlify, Supabase, Cloudflare, CloudWatch. Log drains
- Your runtime: the SDK reports Node.js and OpenSSL versions, and on Pro and Business the hosts your app calls. SDK
- Public advisories: OSV, Node.js, Go, endoflife.date, CISA, and Mozilla, matched inside ShellOrbit. Incident Alerts
Alerts
Paste a channel’s incoming webhook URL in Settings, Alerts. Email is on every plan; Slack, Discord, Teams, and any HTTPS URL from Starter. Alerts
Respond
On Pro and Business, connect a provider with a scoped key so a leaked key can be revoked or rotated, each with ten minutes to cancel: AWS, OpenAI, Anthropic, Google Cloud, Azure, Twilio, SendGrid, and Supabase tables. Leaked GitHub and Hugging Face tokens are reported to their issuer. For anything else, a signed request goes to your own system. Revoke and undo, Revoke in your own system
A safe first connection
- Create a source for a test organization, account, or tenant.
- Paste the URL and secret into the vendor.
- Send the vendor’s test event, or press Send a test event on the source.
- Check the signature result in the source’s events, and the finding the test raised.
- Connect production once the test looks right.
Request access
Connect one system. Hear when it matters.
Tell us what you run. We set up your sources, domains, and tripwires with you, and ready-made rules work the moment a source is connected.