We watch your stack. We never hold your keys.

What Leak Alarm keeps

• A finding keeps the kind of key, where it was found, and a masked form such as sk_…a1b2.
• ShellOrbit never uses a key it finds and never stores or shows one in full, to you or to an AI agent.
• Site checks run only on domains you verified, rechecked before every check.
• Streamed log lines are scanned and dropped. Only findings are kept.
• The SDK sends masked values, one way fingerprints, runtime version numbers, and hostnames, never a path, header, or body. Its DSN can send but not read.

What sources keep

• A source event is stored for your plan’s history window, from 15 to 180 days, then deleted.
• Events from GitHub, AWS, Okta, Auth0, or your app can carry account names, email addresses, and IP addresses. Mark fields to mask in the inspector, and keep only the events your rules need: the AWS guide’s event pattern sends only what the ready-made rules read.
• ShellOrbit never acts in a connected system with a source. A source only receives.

Connections you control

• No app is installed in your accounts and no vendor sign-in is used. Every connection is a URL and secret you paste into the vendor, or a scoped key or webhook URL you paste into ShellOrbit.
• Remove a connection from the vendor’s side and it stops at once.
• Revoking a key needs a provider you connected with a scoped key, and every revoke waits ten minutes for you to cancel.

Incident Alerts and privacy

• Advisories are downloaded from public sources and matched inside ShellOrbit.
• Nothing about you or your stack is sent to those sources.
• It never reads your code or dependency files, and never probes your site.

Our own secrets

Service credentials live only in AWS Systems Manager Parameter Store, encrypted with a dedicated key, readable only by the functions that need them. Never in code, builds, or browsers. Keys are masked before anything is logged.

Sources: verified on arrival

• Signatures are checked on the original bytes for GitHub, Stripe, Shopify, Paddle, Standard Webhooks, and ShellOrbit, on every plan. See the signature guide.
• Rotate a source’s secret at any time.
• IP allowlisting on Business, in addition to signatures.

Your account

• Turn on multifactor authentication.
• Keep API keys on your server, scoped read only where you can.
• Audit log and sign-in history, with IP address and device, on every plan. Sign out any session you do not recognise.
• Sessions end 12 hours after sign-in, even while in use. API keys cannot manage keys or change your account.

Retention and certification

Source events can hold personal data, so keep only what your rules need. Data is encrypted in transit and at rest. These are controls, not a claim of independent certification. See the privacy policy, DPA, and subprocessors.

Report a concern

Follow our responsible disclosure process. Qualifying reports are credited in the Hall of Fame.