We find your leaked keys. We never keep them.

What Leak Alarm keeps, and what it never does

A finding records the kind of key, where it was found, and a masked form such as sk_…a1b2. ShellOrbit never tries to use a key it finds, never stores the full value, and never shows it back to you or to an AI agent connected over MCP.

Scans run only against domains you have verified with a DNS record, checked again before every scan. GitHub repos are read through a read only GitHub App on the repos you choose; code is scanned and discarded, not kept. Log lines you stream are scanned as they arrive and dropped; only findings are stored. The JavaScript SDK sends masked values and one way fingerprints, never the secret, and its DSN can send findings but read nothing.

Automatic revoking happens only for keys you have allowed it on, and every action waits ten minutes for you to cancel it.

The secrets we hold ourselves

ShellOrbit’s own service credentials, such as payment, authentication, and session signing keys, live only in AWS Systems Manager Parameter Store, encrypted with a dedicated key and readable only by the functions that need them. They are not kept in source code, in build systems, or in anything sent to a browser, and keys are masked before a log line or error report is written.

Verify at the boundary

Configure separate provider credentials for Stripe, Paddle, GitHub, Shopify, or the ShellOrbit signature format. Verification uses the original request bytes. Choose quarantine to retain invalid requests without delivering them, or explicitly select observation mode to record failures while forwarding.

Provider verification is available on every plan. IP allowlisting is an additional Business control; it is not a replacement for signature verification.

Sign outbound deliveries

ShellOrbit signs outbound requests with an endpoint-specific key. Administrators can rotate it from endpoint settings. Copy the new key when it is shown, then update your destination. A 24-hour overlap allows both signatures during the transition.

Do not reuse provider secrets as your ShellOrbit signing key. Read the signature guide for the header format and verification examples.

Protect account access

Enable multifactor authentication. Use scoped API keys for server-side integrations and keep them out of browser code. Organization membership is checked on authenticated requests so removed members lose access.

Understand retention

Raw payloads can contain personal data. Choose the plan and workflow that match what you need to retain. Bookmarks expire with their events. Test fixtures require explicit review and have a separate, limited retention period.

Transport uses HTTPS. Infrastructure provisions encryption for stored event data. These controls are not a claim of independent certification. Review the privacy policy, DPA, and subprocessors for the contractual detail.

Report a concern

Use our responsible disclosure process. We recognize qualifying reports in the Hall of Fame, including the researchers who help improve account and application security.