Alerts

shellz raises an alert when a server goes silent, a recording has a gap, someone tampers with the recorder, or a session can't be recorded. Alerts appear on the server or fleet page and are sent to your alert destinations within a minute.

Alert destinationsCopy Anchor Link

Owners and admins configure destinations in ~/security, under Alert destinations. Click Add destination, choose the type, enter the target and click Save.

Each destination can be switched on or off. Until you add one, alerts are emailed to the org's owners.

Webhook payloadCopy Anchor Link

shellz sends a POST with a JSON body:

{
  "type": "alert",
  "alert": {
    "id": "8f0c...",
    "orgId": "1b2e...",
    "serverId": "6f1c...",
    "fleetId": null,
    "serverName": "prod-api-01",
    "kind": "tamper-repaired",
    "message": "the recorder unit was modified and has been restored",
    "severity": "critical",
    "at": "2026-11-04T10:12:03.000Z"
  },
  "url": "https://app.shellz.dev/servers/6f1c..."
}

Verifying the signatureCopy Anchor Link

When you add a webhook, shellz shows a signing secret once. Every delivery then carries two headers:

• X-Shellz-Timestamp: the send time in milliseconds since the Unix epoch;
• X-Shellz-Signature: the hex HMAC-SHA256 of <timestamp>.<raw body>, keyed with the secret.

import { createHmac, timingSafeEqual } from "node:crypto";

export function verify(secret, timestamp, rawBody, signature) {
  const expected = createHmac("sha256", secret).update(`${timestamp}.${rawBody}`).digest("hex");
  const fresh = Math.abs(Date.now() - Number(timestamp)) < 5 * 60_000;
  return fresh && timingSafeEqual(Buffer.from(expected), Buffer.from(signature));
}

Compute the HMAC over the body exactly as received, before parsing it. Rejecting old timestamps protects against replayed deliveries.

Alert referenceCopy Anchor Link

Severity is critical, warning or info. While a server or fleet member has an open critical alert, the dashboard shows it as tampered.

Server healthCopy Anchor Link

TamperingCopy Anchor Link

RecordingCopy Anchor Link

ContainersCopy Anchor Link

Repeated alerts of the same kind are grouped, with a count.