Domain scans
What Leak Alarm checks on your live site, how often, and what it never does.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
What a scan checks
A scan reads your verified domain the way a visitor’s browser does and looks for:
- Keys and tokens in the code your site sends to browsers, such as live Stripe, OpenAI, AWS, and GitHub keys, and a Supabase service role key.
- Exposed
.env,.git, and source map files. - Supabase tables that anyone holding your public key can read.
- Firebase rules that leave data open.
- Missing security headers.
Hobby scans weekly. Starter, Pro, and Business scan every verified domain daily, and you can start a scan from the dashboard at any time.
What a finding contains
The kind of key or problem, the URL and file where it was found, a masked form such as sk_…a1b2, how serious it is, and the fix: in plain words, and as a prompt you can paste into Lovable, Cursor, or Bolt. Each finding is one event from your monthly allowance; scans themselves are never counted.
What a scan never does
- It never uses a key it finds, not even to check whether it works.
- It never stores a key in full.
- For an open Supabase table it records the table name and that it can be read. It never copies rows.
- It never scans a domain that is not verified, and it fetches only the pages and files a browser would.
When a scan finds something
You get an email straight away, and on Pro and Business also Slack, Discord, or a webhook. On Pro and Business, a leaked AWS, OpenAI, or GitHub key can be revoked for you, with ten minutes to cancel. See Revoke and undo.