Simple plans. Explicit limits.
Room for your next stage.
Start free with one domain watched, three tripwires, and 15,000 events a month. Leak Alarm and webhooks come on every plan, and higher plans add coverage, volume, and retention.
Four plans, one event allowance
Every plan includes Leak Alarm and the webhook pipeline underneath it. Higher plans raise coverage, volume, and retention rather than unlocking reliability.
Hobby
For side projects and the first users of a new app.
$0 per month
15,000 events per month
1 verified domain for ingest URLs and leak scans
Leak Alarm
- Scanned weekly
- 1 GitHub repo
- 3 tripwires
Webhooks
- 15 day retention and replay
- 1 endpoint, 1 destination
- Fixed retry policy, 5 attempts
- Audit log and sign-in history, last 30 days
- Email support, reply within 7 working days
Starter
For a small production app with paying users.
$20 per month
75,000 events per month, then $0.50 per 1,000
10 verified domains for ingest URLs and leak scans
Leak Alarm
- Scanned daily
- 5 GitHub repos
- 15 tripwires, fake AWS keys included
- 1 GB of logs scanned a month
- Alerts when your real key turns up
- Weekly security digest
Webhooks
- 30 day retention and replay
- 5 endpoints, 5 destinations each
- Configurable attempts and backoff
- Audit log and sign-in history, last 60 days
- Email support, reply within 5 working days
Pro
Where most solo developers land after Starter.
$49 per month
150,000 events per month, then $0.40 per 1,000
30 verified domains for ingest URLs and leak scans
Leak Alarm
- Everything in Starter
- 20 GitHub repos
- 50 tripwires
- 10 GB of logs scanned a month
- Block responses that carry a secret
- Public Postman workspace checks
- Revoke leaked keys, lock open Supabase tables
Webhooks
- Everything in Starter
- 60 day retention and replay
- 30 endpoints, 30 destinations each
- Payload transformation before forwarding
- 3 team seats
- Slack, Discord and webhook alerts
- Audit log and sign-in history, last 90 days, CSV export
- Priority email support, reply within 3 working days
Business
For products where a leaked key or a lost webhook becomes a support queue.
$149 per month
750,000 events per month, then $0.30 per 1,000
Unlimited verified domains for ingest URLs and leak scans
Leak Alarm
- Everything in Pro
- Unlimited GitHub repos
- 200 tripwires
- 50 GB of logs scanned a month
- Revoke at every supported provider
Webhooks
- Everything in Pro
- 180 day retention and replay
- Unlimited endpoints and destinations
- 5 team seats, buy more at any time
- IP allowlisting
- Audit log and sign-in history, last year, CSV export
- Dedicated account manager, reply within 1 working day
Every plan includes
Leak Alarm
- Live site checks for keys in browser code and exposed .env, .git, and source map files
- Checks for open Supabase tables and Firebase rules
- GitHub repos scanned on every push, full history when connected
- An alert within seconds when a connected repo is made public
- JavaScript SDK with a DSN that masks keys in your logs before they are written
- Tripwires: fake links, emails, and database rows
- Fix prompts for Lovable, Cursor, and Bolt, and email alerts
- MCP server, so Claude, Cursor, and other agents can read findings and fix them
- Each finding or tripwire hit is one event. Scans and scanned logs are never counted
Webhooks
- Provider signature verification, Standard Webhooks included
- Ingest URLs on your own verified domain
- Dashboard event inspector, search and filtering
- Email alerts, and a warning at 90 percent of events
- Weekly delivery health digest
- REST API, MCP server, CLI forwarding to localhost, and sending your own events
- Audit log and sign-in history, with IP address, device, and location
- Circuit breaker on a failing destination
- 99.9 percent uptime commitment
On smaller screens, scroll the table to compare every plan.
| Feature | Hobby $0 per month | Starter $20 per month | Pro $49 per month | Business $149 per month |
|---|---|---|---|---|
| Volume and limits | ||||
| Events included each month | 15,000 | 75,000 | 150,000 | 750,000 |
| Usage beyond that, per 1,000 events | Not available | $0.50 | $0.40 | $0.30 |
| Free trial for first time subscribers | Free plan, no trial needed | 7 days | 7 days | 7 days |
| Retention and replay | 15 days | 30 days | 60 days | 180 days |
| Endpoints | 1 | 5 | 30 | Unlimited |
| Destinations per endpoint | 1 | 5 | 30 | Unlimited |
| Verified domains, each subdomain counted on its own | 1 | 10 | 30 | Unlimited |
| Use a verified domain for ingest URLs, leak scans, or both | Included | Included | Included | Included |
| Team seats | 1 | 1 | 3 | 5 included, buy more |
| Leak Alarm | ||||
| Scans of each verified domain | Weekly | Daily | Daily | Daily |
| Keys in browser code, exposed .env and .git files, open Supabase tables and Firebase rules | Included | Included | Included | Included |
| GitHub repos scanned on every push | 1 | 5 | 20 | Unlimited |
| Alert when a connected repo is made public | Included | Included | Included | Included |
| JavaScript SDK: keys masked in your logs before they are written | Included | Included | Included | Included |
| SDK response guard for secrets in what your server sends | Report | Report | Report or block | Report or block |
| Log drains from Vercel, Netlify, Supabase, Cloudflare, and CloudWatch | Not included | 1 GB a month | 10 GB a month | 50 GB a month |
| Alert when your real key turns up in a scan, repo, or log | Not included | Included | Included | Included |
| Public Postman workspace checks | Not included | Not included | Included | Included |
| Tripwires: fake links, emails, and database rows | 3 | 15 | 50 | 200 |
| Fake AWS key tripwires | Not included | Included | Included | Included |
| Fix prompts for Lovable, Cursor, and Bolt | Included | Included | Included | Included |
| Weekly security digest | Not included | Included | Included | Included |
| Revoke leaked AWS, OpenAI, and GitHub keys, with 10 minutes to cancel | Not included | Not included | Included | Included |
| Lock an open Supabase table | Not included | Not included | Included | Included |
| Revoke at every supported provider | Not included | Not included | Not included | Included |
| Delivery | ||||
| Circuit breaker on a failing destination | Included | Included | Included | Included |
| Configurable attempts and backoff | Not included | Included | Included | Included |
| Fan out to several destinations | Not included | Included | Included | Included |
| Payload transformation before forwarding | Not included | Not included | Included | Included |
| Provider signature verification, Standard Webhooks included | Included | Included | Included | Included |
| IP allowlisting | Not included | Not included | Not included | Included |
| Send your own events through the API | Included | Included | Included | Included |
| Visibility | ||||
| Dashboard event inspector | Included | Included | Included | Included |
| Event search and filtering | Included | Included | Included | Included |
| Email alerts on repeated failure | Included | Included | Included | Included |
| Usage warning at 90 percent of included events | Included | Included | Included | Included |
| Weekly delivery health digest | Included | Included | Included | Included |
| Slack, Discord and webhook alerts | Not included | Not included | Included | Included |
| Audit log and sign-in history, with IP address and location | 30 days | 60 days | 90 days | 1 year |
| Export the audit log as CSV | Not included | Not included | Included | Included |
| REST API with read only or read write keys | Included | Included | Included | Included |
| MCP server for Claude, Cursor, and other AI agents | Included | Included | Included | Included |
| Forward events to localhost with the CLI | Included | Included | Included | Included |
| Support and commitments | ||||
| Support | Priority email | Dedicated account manager | ||
| Support reply time | 7 working days | 5 working days | 3 working days | 1 working day |
| 99.9 percent monthly uptime commitment | Included | Included | Included | Included |
First time subscribers get a 7 day free trial on any paid plan, and nothing is charged until it ends. Pay yearly and two months come off the price. Usage above your included volume is billed by the thousand at the rate shown on your plan, so a busy week costs a few dollars instead of a forced upgrade.
Leak Alarm shares your event allowance: each finding and each tripwire hit is one accepted event, while scans, repo pushes, and the log lines we scan are never counted. The SDK never sends a key to ShellOrbit, only a masked form and a one way fingerprint, and its DSN can send findings but read nothing. Domains are shared too. Verify a hostname once with a DNS record, then use it for custom ingest URLs, leak scans, or both, and it counts once. Every hostname is its own domain, so example.com and app.example.com are two, each with its own record. The record is checked again before every scan, and scanning stops if it is gone. ShellOrbit reports a key it finds without ever trying to use it.
Support reply times are targets measured in working days, Monday to Friday, from the moment your message reaches support@shellorbit.com. Business accounts have a named account manager who knows your setup.
Payments are handled by Dodo Payments as merchant of record. Dodo Payments collects sales tax, VAT, and GST where it applies and appears on your statement as the seller. Prices are in United States dollars and exclude tax, which is added at checkout where local rules require it.
Estimate your monthly usage
Estimate one plan using accepted incoming events. Retries and fan-out do not add incoming-event usage. Taxes and extra seats are excluded.
A safety ceiling can reject new events before the end of a billing period. This estimate is not a promise that all volumes will be accepted.
Know what is included
Event retention: Hobby 15 days, Starter 30, Pro 60, Business 180. Bookmarks follow event retention; separately saved fixtures have an explicit expiry.
Annual subscriptions charge ten times the monthly base price. Usage overage and additional seats are separate. Paid plans include the stated team seats; check billing before purchasing more.
More pricing and product questions →Start free
Watch your app. Keep every event.
Verify a domain for a free leak scan and three tripwires, or point a provider at an endpoint. Both run on one account and one event allowance.