Tripwires

These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.

How a tripwire works

A tripwire is a fake secret you plant where your real data lives. Nobody has a reason to touch it, so the first time it is used, something has leaked: a dumped table, a copied config file, a repo made public, an AI agent that read more than it should. It works however the leak happened, which is why it catches what scans miss.

Kinds of tripwire

Tripwires: Kind, Where to plant it, What trips it
Kind	Where to plant it	What trips it
Link	A document, a config file, an internal page	Anyone opening the link
Email address	A users table, a mailing list export	Anyone sending mail to it
Database row	A fake user in your users table, with a tripwire email and link	Anyone emailing the address or opening the link
Fake AWS key	A `.env` file, CI settings, a secrets folder	A call to its ShellOrbit endpoint, or the key turning up somewhere public

What a fake AWS key can and cannot catch

A fake AWS key is generated by ShellOrbit. It looks exactly like a real one, an access key ID starting with AKIA and a 40 character secret, but no AWS account knows it, so it can never touch anything. The dashboard gives you a snippet to paste into a .env file:

bash
AWS_ACCESS_KEY_ID=AKIA…
AWS_SECRET_ACCESS_KEY=…
AWS_REGION=us-east-1
AWS_ENDPOINT_URL=https://…/k/…

It catches:

Anyone who uses the whole file. AWS SDKs and the AWS CLI send their calls to AWS_ENDPOINT_URL when it is set, so a dumped .env loaded as it is calls ShellOrbit, not AWS. That call is a hit, with the source address and user agent.
The key turning up where it should not. The access key ID is a hit when ShellOrbit finds it in a public repo or a repo made public, or in your log drains. A copy in the private repo or .env where you planted it is not a hit.
The SDK’s tripwire. The key the SDK plants works the same way.

It cannot catch:

Someone who copies only the two key values and calls AWS directly. AWS rejects the key as unknown and does not tell ShellOrbit, so that use is silent. Catching it would need a real AWS account to hold the keys, which ShellOrbit does not run.
A leak nobody acts on and that never appears anywhere ShellOrbit looks.

So a fake key is a strong signal when it fires and no proof of safety when it stays quiet. Pair it with the scans, repos, and log drains.

What a hit records

The time, the tripwire, what was touched, and the source address and user agent of the request that touched it. Each hit is one event from your allowance and alerts you within seconds.

Tripwires: Plan, Tripwires
Plan	Tripwires
Hobby	3, without fake AWS keys
Starter	15, fake AWS keys included
Pro	50
Business	200

Rules

Plant tripwires only in systems you own or are authorised to protect. A tripwire records a request and alerts you; it never runs anything on the visitor’s machine. Do not use tripwires to track people, for example in emails to customers.