GitHub repos
Scan the repos you connect for keys in their full history and in every push, and hear within seconds when one is made public.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
Connect GitHub
In Leak Alarm, GitHub, choose Connect GitHub. GitHub asks you to install the ShellOrbit app on your account or organisation and to pick which repos it may see, then sends you back to the dashboard. ShellOrbit checks with GitHub that the installation is really yours before linking it, so an installation can belong to one ShellOrbit account only.
The app asks for read only access to contents and metadata, and for push and repository events. It cannot write to your code, open pull requests, or change settings. To disconnect, uninstall the app in GitHub; ShellOrbit stops scanning at once.
How many repos
| Plan | Repos scanned |
|---|---|
| Hobby | 1 |
| Starter | 5 |
| Pro | 20 |
| Business | Unlimited, up to 300 under fair use |
Repos past your plan’s limit are listed in the dashboard but not scanned. Give the app access to fewer repos in GitHub, or upgrade, to choose which ones count.
What is scanned
- The full history, once. When a repo is connected, every commit on every branch is read. Large repos are cloned into a short lived job, scanned, and the clone is deleted when the job ends, within an hour at most.
- Every push after that. Only the lines a push adds are read, from GitHub’s own diff, within seconds of the push. A push too large for GitHub’s diff, more than 300 files, gets a full history scan instead.
Lock files, minified files, source maps, and vendored folders such as node_modules are skipped. A finding names the file, the line, and the commit, the kind of key, and a masked form such as ghp_…9f2c. Your code is never stored; only findings are. Each new finding is one event.
On Starter, Pro, and Business, a key that matches one of your own keys fingerprinted by the SDK is reported as your real key, and raised to critical.
A repo made public
GitHub tells ShellOrbit the moment a connected private repo is made public. You get a finding for that straight away, and the repo’s full history is scanned again, so you hear about any live key in it before anyone else finds it.
A tripwire value committed to a private repo is not a finding: that is where you planted it. The same value in a public repo is a hit.
Removing a key from history
Deleting a key in a new commit does not remove it from history, and anyone who cloned the repo still has it. Revoke the key first, then rewrite history if you need to. On Pro and Business a leaked GitHub token can be revoked for you; see Revoke and undo.