Log drains
Stream your platform's logs to ShellOrbit, and keys that reach a log become findings.
These pages describe ShellOrbit as it runs today. Breaking changes to the HTTP API are announced before they ship, and existing request and response shapes stay supported.
Why logs
A log line is the easiest place for a key to leak: a debug print, an error that dumps a request, a library that logs headers. Logs are then kept, copied, and shared with every tool that reads them.
Set up a drain
In Leak Alarm, Log drains, add a drain and choose your platform. Each drain gets its own URL with a long random token in it; treat the URL as a secret. The dashboard also makes a secret for the drain and shows it once, to paste where the table below says, so a request without it is refused.
| Platform | Where to paste the URL | How the secret is checked |
|---|---|---|
| Vercel | Team settings, Log Drains, custom endpoint | Vercel signs each batch with your secret; ShellOrbit checks the signature. Put Vercel’s verification value in the drain’s verify field. |
| Netlify | Site settings, Log Drains, general HTTP endpoint | Netlify does not sign its log drains, so a Netlify drain must have a secret. Put Bearer <secret> in Netlify’s Authorization header field. |
| Supabase | Project settings, Log Drains, HTTP endpoint | An Authorization: Bearer header with your secret. |
| Cloudflare | Logpush job with an HTTP destination | Add header_Authorization=Bearer%20<secret> to the destination. |
| AWS CloudWatch | A subscription filter to an Amazon Data Firehose stream with an HTTP endpoint destination | The Firehose access key: set it to your secret. |
Any platform can also send the secret in an X-ShellOrbit-Drain-Secret header. Gzip bodies are accepted.
What happens to your logs
Each batch is scanned for keys as it arrives and then dropped. Only findings are stored: the kind of key, the time, the drain, and a masked form. Scanned lines never count as events; each new finding is one event. A tripwire value that shows up in your logs is a hit.
On Starter, Pro, and Business, a key that matches one of your own keys fingerprinted by the SDK is reported as your real key.
Limits
| Plan | Logs scanned each month |
|---|---|
| Hobby | Not included |
| Starter | 1 GB |
| Pro | 10 GB |
| Business | 50 GB |
Volume is counted after decompression and shared by all of an account’s drains. An account can hold 20 drains, and each drain takes up to 600 batches a minute of up to 6 MB.
When a month’s volume is used, scanning stops until the first of next month, the drain is marked as paused in the dashboard, and you get one notice that month by email and through your alert channels. Your platform’s requests are still accepted, so it does not retry or switch the drain off, but the logs are not read. Nothing is billed for the overflow. To catch keys in logs without a drain, use the JavaScript SDK.