A security alarm for your stack.

Connect

A source is a URL and a secret. Create one in Settings, Integrations, paste both into the vendor, and the vendor starts sending its events. There is no app to install in your accounts and no broad access to grant.

• GitHub: an organization webhook, signed with your secret. Guide
• AWS: CloudTrail events through an EventBridge rule and API destination. Guide
• Okta and Auth0: an event hook, or a custom webhook log stream. Okta, Auth0
• Your own app: sign in, MFA, role, and API key events in one small JSON format. Guide
• Anything else that signs its webhooks: Stripe, Shopify, Paddle, Standard Webhooks senders such as Clerk and Resend, with your own rules. Guide

Every request’s signature is checked before a rule reads it. The source event inspector shows what arrived, with fields you choose masked.

Detect

• Ready-made rules, on every plan, for every source: a repository made public, a root sign in, CloudTrail stopped, a burst of failed sign ins, MFA turned off, a new administrator. Rules
• Custom rules, from Starter: match a header or a field, optionally more than N times in M minutes, at the severity you choose.
• Silent sources, from Starter: one finding when a source sends nothing for the hours you set. Silent sources
• Outbound traffic watch, on Pro and Business: the SDK reports the hosts your app and its packages call, and a new one after the first day is a finding. Outbound traffic watch

Leak Alarm

Leak Alarm finds secrets your app gives away and tells you when one is used. On every plan.

• Site checks on verified domains: keys in browser code and source maps, exposed .env and .git, open Supabase tables and Firebase rules, missing security headers, certificate expiry and distrusted authorities. Site checks
• Logs: stream from Vercel, Netlify, Supabase, Cloudflare, or CloudWatch. Keys become findings; lines are dropped. Log drains
• SDK: masks keys in your logs, can block a response that carries a secret, and reports your Node.js and OpenSSL versions. SDK
• Tripwires: fake links, emails, database rows, and from Starter fake AWS keys. A hit means something leaked. Tripwires

Every plan checks sites daily. ShellOrbit never uses a key it finds and never stores one in full.

Incidents

When a public security incident lands, Incident Alerts tells you if it affects you, where, the fix, and the deadline.

• Feeds: OSV, Node.js releases, the Go vulnerability database, endoflife.date, the CISA catalog of exploited flaws, Mozilla’s distrusted certificates, and our own write ups.
• Matched against: your domains’ certificates and server headers, SDK runtime versions, the services your findings name, and the stack you declare.
• Private: matching runs inside ShellOrbit. Nothing about your stack goes to the feeds.

It never reads your code and never probes your site, and it cannot catch a flaw nobody has announced. How Incident Alerts work

Respond

• One feed for every finding, from every source, to acknowledge and resolve, with who did it and when. Findings
• Alerts by email on every plan, and from Starter in Slack, Discord, Teams, or any URL. Alerts
• Revoke or rotate, on Pro and Business, at 8 providers, with ten minutes to cancel, or a signed request to your own system. Revoke
• Explain a finding in plain words with your own AI provider key, or let your agent read it over MCP.

Configure

• Team members with owner, admin, member, and viewer roles.
• Audit log and sign-in history, with IP address and device, on every plan: 60 days on Starter to a year on Business.
• Findings and source event history: 30 days on Starter to 180 days on Business.