Catch the leak. Keep every event.

Protect

Leak Alarm watches the app you ship for secrets it should never show, and tells you the moment a planted one is used. It is on every plan, Hobby included, and its limits grow with the plan. It suits apps built quickly with tools like Lovable, Bolt, Replit, and Cursor, where a key in the wrong file is easy to miss.

Scan. Verify a domain once with a DNS record, the same verification that puts your ingest URLs on your own domain, and ShellOrbit checks the live site: keys in the code sent to browsers, exposed .env, .git, and source map files, Supabase tables anyone can read, and open Firebase rules. Each hostname is verified and counted on its own, so example.com and app.example.com are two domains. The record is checked again before every scan, and scanning stops if it is gone. Hobby scans weekly and paid plans scan daily. ShellOrbit reports a key it finds and never tries to use it.

Tripwires. Plant fake links, email addresses, and database rows where your real data lives, and on paid plans fake AWS keys. Nobody has a reason to touch them, so a hit means something leaked: a dumped table, a copied config file, an AI agent that read more than it should. Each hit arrives as an event, uses one event from the same allowance as your webhooks, and alerts you.

Fix. Every finding comes with the fix in plain words, and as a prompt you can paste into Lovable, Cursor, or Bolt. Or connect your agent to the ShellOrbit MCP server and let it read the finding and make the fix in your code. It sees masked keys only, and anything that changes your account needs a read write key and your confirmation.

Contain. On Pro and Business, ShellOrbit can revoke a leaked key at AWS, OpenAI, or GitHub, or lock an open Supabase table. You choose which keys it may act on, and every automatic action waits ten minutes for you to cancel it.

Leak Alarm detects and contains leaks. It does not make a vulnerable app safe, so fix what it finds. See pricing for the limits on each plan.

Receive

Create an endpoint and paste its ingest URL into your provider. Set one or more destinations according to your plan. ShellOrbit stores accepted events before asynchronous delivery, so your application does not have to be available at receipt time.

Keep the ingest URL private: it allows anyone holding it to submit events. Enable provider verification to distinguish authentic requests from invalid signatures.

Investigate

Filter events by endpoint, state, time, or event identifier. Inspect the stored body, headers, response excerpt, and delivery attempts. Optional live updates let you watch a test event arrive without repeatedly refreshing the page.

A successful HTTP response is delivery acknowledgement. It does not prove that a payment was reconciled or a background job completed. Optional processing receipts let your application report that separate outcome.

Recover

Automatic retries follow the endpoint policy. After retries are exhausted, the event remains available until its retention expires. A manual replay creates a separate delivery run so the original attempt history remains inspectable.

The recovery workspace prepares a selection of failed deliveries, starts a small canary batch, and asks you to continue after it succeeds. Recovery uses current endpoint configuration. Your handler must remain safe to call more than once.

Configure

Edit destinations and retry policy from the endpoint page. On Pro and Business, preview declarative transformations against sample JSON before enabling them. The preview sends no request to a destination.

Separate endpoints can represent different providers or application environments. Use explicit names such as billing-staging and billing-production to make the intended destination easy to recognize.

Keep developing

Save useful events as bookmarks while they remain in retention. For longer-lived regression examples, explicitly create sanitized test fixtures with their own expiry and export them for local or staging tests.