Connects where your keys live.

Leak Alarm connections

Each part has its own documentation page.

• GitHub. A read only GitHub App on the repos you choose. Full history is scanned once, then every push, and you are alerted within seconds if a connected repo is made public. GitHub repos
• Supabase and Firebase. Domain scans find tables and rules anyone can read. Pro and Business can lock an open Supabase table. Scans
• Log platforms. Vercel, Netlify, Supabase, Cloudflare, and AWS CloudWatch can stream logs to ShellOrbit. Lines are scanned for keys and dropped. Log drains
• Postman. With your own Postman key, Pro and Business check whether any of your workspaces are public and carry keys.
• AWS, OpenAI, and GitHub keys. On Pro and Business, ShellOrbit can revoke a leaked key at the provider, with ten minutes for you to cancel. Revoke and undo
• Lovable, Bolt, Cursor, and Claude. Every finding comes with a fix prompt, and agents can connect over the MCP server.

Webhook providers

The same pipeline receives your provider webhooks, verifies their signatures on the original bytes, and delivers them with retries.

Payments

Stripe setup guide: receive payment and subscription events, configure the endpoint signing secret, and verify the first delivery.

Paddle setup guide: connect notification destinations and validate the Paddle signature before forwarding.

Commerce

Shopify setup guide: receive store events and configure HMAC verification with your app’s appropriate secret.

Development

GitHub setup guide: receive repository events, verify the webhook secret, and plan explicitly for redelivery.

Other HTTP providers

ShellOrbit can receive HTTP webhook requests from other services. Native signature verification currently supports the providers above and the ShellOrbit format. Check your provider’s request format, retry behavior, and payload limits before moving production traffic.

A safe first connection

1. Create a staging endpoint and set a test destination.
2. Configure the provider’s webhook URL and secret.
3. Send the provider’s test event.
4. Confirm the signature result and destination response in Events.
5. Move production traffic only after your handler verifies signatures and handles duplicates.