A security alarm for your stack

Know the moment something risky happens.

Connect GitHub, AWS, your sign-in provider and your own app. ShellOrbit watches what they report, tells you when something looks like an attack, and helps you shut it down.

Free for 1 source and 1 domain. You set every connection up yourself, in minutes.

Connect what you already run. Each one takes a URL and a secret you paste in yourself.

GitHubA repository made public, a new owner, protection removed
AWSRoot sign in, a console sign in without MFA, CloudTrail stopped
Okta and Auth0Bursts of failed sign ins, MFA turned off, a new admin
Your appYour own sign in and admin events, in one simple format

One system

Connect, detect, alert, respond.

Ready-made rules work the moment a source is connected. Nothing to write before the first alert.

1 Connect
Sources
GitHub, AWS through EventBridge, Okta, Auth0, your own app, or any signed webhook
Your site
Verify a domain for leaked keys, exposed files and certificate checks
Your code at runtime
The SDK masks secrets in logs and reports the hosts your app calls
Tripwires
Fake keys, links, emails and rows planted where your data lives
2 Detect
Ready-made rules
On for every source, every plan
Custom rules
Match a field, or more than N in M minutes, from Starter
Silent sources
A source that stops sending, such as CloudTrail turned off
Incidents
Public advisories matched to what you run
3 Alert
Email
Critical and high, every plan
Channels
Slack, Discord, Teams or any URL, from Starter
One feed
Every finding in one place, to acknowledge and resolve
Digest
Weekly, in weeks with something to report
4 Respond
Revoke and rotate
At 8 providers, with ten minutes to cancel, on Pro and Business
Your own system
A signed request so it can act on a finding
Explain
Plain words from your own AI provider key
History
Who acknowledged, who resolved, and when

Incident Alerts

When the next Log4j lands, know quickly if it reaches you.

Public advisories, matched to what you actually run. You hear only about what affects you, with the evidence, the fix and the deadline.

Feeds: OSV, Node.js, Go, end of life dates, CISA, Mozilla and our own advisories
Speed: Within minutes of an advisory reaching a public feed
Resolves: On its own, once the fix is in

How Incident Alerts works →

Incidents this week Example account

Example: this week's public incidents, checked against one account
Incident	What was checked	State
Certificate authority keys compromised. Node.js 26.12.1 distrusts them	Node.js 26.12.0, reported by the SDK in checkout-api	Affected
A vendor confirms a breach of its hosted database	The service, in your declared stack	Affected
A PHP remote code execution flaw	No PHP on your verified domains or in your stack	Not affected

For AI agents

Ask your agent what needs attention.

Connect Claude, Cursor or any MCP client with an API key. A read key can look and never change anything.

Connect an agent API reference →

MCP
you    Anything open from last night?

agent  list_findings
       critical  CloudTrail logging stopped
                 AWS production, 06:12, acknowledged
       high      Private repository made public
                 acme/billing, open
       high      41 failed sign ins in 5 minutes
                 Okta, open

Set up in minutes

Paste a URL and a secret. That is the whole integration.

No app to install in your accounts and no broad access to grant. You configure each source yourself, in the vendor's own settings, and ShellOrbit checks every request's signature before a rule reads it.

Intake: POST /e/{ingest_key}, 202 once stored
Signatures: GitHub, Stripe, Shopify, Paddle, Standard Webhooks, ShellOrbit
Rules: Ready-made per source, plus your own
History: 15 to 180 days of source events, by plan
Payloads: Up to 5 MB, with fields you mark masked

Sources guide Developer tools →

GitHub

Organization settings, Webhooks
Payload URL    https://hooks.shellorbit.com/e/$INGEST_KEY
Content type   application/json
Secret         $SOURCE_SECRET
Events         Repositories, Branch protection rules,
               Repository rulesets, Deploy keys,
               Organizations, Secret scanning alerts
Findinghigh      Private repository made public
          acme/billing, by octocat

GitHub signs every delivery with the secret, and ShellOrbit checks the signature before any rule runs.

Connect GitHub →

AWS

EventBridge rule, event pattern
{
  "detail-type": [
    "AWS Console Sign In via CloudTrail",
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventName": [
      "ConsoleLogin", "StopLogging", "DeleteTrail", "UpdateTrail",
      "CreateAccessKey", "CreateUser", "AttachUserPolicy",
      "AttachRolePolicy", "AuthorizeSecurityGroupIngress",
      "DeleteBucketPublicAccessBlock", "DeleteDetector",
      "DisableSecurityHub", "ScheduleKeyDeletion"
    ]
  }
}
Findingcritical  CloudTrail logging stopped
          us-east-1, by IAM user deploy-bot

The rule sends only the CloudTrail events the ready-made rules read, to an EventBridge API destination pointed at your source.

Connect AWS →

Your app

terminal
BODY='{"type":"login.failed","actor":"user_42","ip":"203.0.113.7","country":"IN"}'
TS=$(date +%s)
SIG=$(printf '%s.%s' "$TS" "$BODY" | openssl dgst -sha256 -hmac "$SOURCE_SECRET" | sed 's/^.* //')
curl -X POST "https://hooks.shellorbit.com/e/$INGEST_KEY" \
  -H "content-type: application/json" \
  -H "ShellOrbit-Signature: t=$TS,v1=$SIG" \
  -d "$BODY"
ResponseHTTP/2 202
{"id":"evt_01m4d6rgyr4pfks4hy1fbpkz3b","received_at":"2026-10-25T09:30:00Z"}

Send sign in, MFA, role and API key events from your own code. Ten failed sign ins in five minutes becomes a finding.

Send your app's events →

SDK

server.js
import { init } from "@shellorbit/sdk";

// Masks keys in your logs, reports your runtime for Incident Alerts,
// and reports the hostnames your app and its packages call.
init({ dsn: process.env.SHELLORBIT_DSN });
Findinghigh      A package called a host never seen before
          checkout-api, initiator: an npm package

Hostnames only, never a path, header or body. The first day is a baseline; after that a new host is a finding.

Outbound traffic watch →

.codetabs__list{display:none}.codetabs__panels{display:block}.codetabs__panel{visibility:visible}.codetabs__panel+.codetabs__panel{margin-top:var(--space-10)}.codetabs__label{display:block}

Honest limits

What ShellOrbit does not do.

Not a code scanner: It watches what your systems report and what you ship, never your repository's code.
Not in your request path: Nothing sits between your users and your app. The SDK only observes.
Only what you connect: It sees the events your sources send, and nothing a source does not report.
Not everything: Undisclosed flaws, unreported events and quiet attackers cannot be matched.

$0, $20, $49, $149 a month

Every plan includes ready-made rules and Incident Alerts

1 source, 1 domain and 3 tripwires free

Compare every plan →

Free for 1 source

Connect one system. Hear when it matters.

One source, one verified domain, three tripwires, and Incident Alerts for your stack, free. Ready-made rules work the moment the source is connected.