wif.tax

Orca Security

F Orca Cloud Security Platform

Workloads call the Orca API, MCP server, Terraform provider and CI actions with a static API token sent as "Authorization: Token"; no OIDC or workload identity path exists. Tokens take a role and scope, but "Never Expire" is a checkbox, API rotation and last use are not publicly documented, and GitHub does not report leaks. Into your cloud, AWS and Alibaba onboarding use a cross-account role; Snyk, Cloudflare, Akamai, Zscaler and Terraform Cloud integrations want static secrets.

Low confidence. docs.orcasecurity.io is behind a login. Token hygiene comes from third-party integration guides, rotation API and last-used fail as not publicly verifiable, and Azure, GCP and OCI onboarding are unverified. Publishing the documentation is how a vendor gets credit.

Docs: docs.orcasecurity.io · Checked 2026-10-22 · source YAML · dispute via PR

Inbound F

How a workload running anywhere authenticates to this product.

Static Orca API token (optionally a "Service Token" not tied to a user) with a role and scope, sent directly as "Authorization: Token <token>" to api.orcasecurity.io, the MCP server, the Terraform provider, orca-cli and the Shift Left GitHub Actions. OAuth 2.0 exists only as a browser flow for interactive MCP clients.

Orca's docs portal (docs.orcasecurity.io) redirects to a region-selection login, so the API token and onboarding pages are not publicly verifiable; this card relies on Orca's public site, Orca's own GitHub repos (Terraform provider, MCP template, GitHub Actions, orca-skills) and third-party integration guides (Vanta, Expel, Observe, Tines, Cloudaware, Truto) that walk through Orca's token dialog. Every documented automation path sends the long-lived token itself as the bearer credential. A session endpoint can trade the token for a session, but the weakest path a workload must use (Terraform, MCP, Shift Left actions, serving-layer API) takes the raw token, so this is graded as a static key, not C. No OIDC, GitHub Actions OIDC, cloud workload identity or token exchange is documented: Orca's own GitHub Actions store the token in GitHub Secrets. The MCP server's OAuth is a browser consent flow for humans.

Outbound B

How this product reaches into your cloud, repos, or other SaaS.

AWS onboarding deploys a CloudFormation stack that creates OrcaSecurityRole trusting Orca's AWS account with an External ID; Alibaba Cloud uses a RAM role template; S3 export trusts Orca's uploader role. Third-party integrations (Snyk, Cloudflare, Akamai, Zscaler ZPA, Terraform Cloud) want a static API token or OAuth client secret stored in Orca.

Checked: cloud onboarding for AWS, Azure, GCP, OCI and Alibaba; S3 bucket export; and the third-party integrations exposed in Orca's Terraform provider (Snyk, Cloudflare, Akamai, Zscaler ZPA, Terraform Cloud; ticketing and alerting targets such as Jira, ServiceNow, Slack, PagerDuty, Opsgenie, Splunk and Sentinel push findings out and were not counted). AWS is keyless: Orca's CloudFormation template (seen in a public copy, since Orca's docs are login-walled) creates OrcaSecurityRole trusting Orca's account 976280145156 with an sts:ExternalId condition that Orca issues. Alibaba is keyless per Orca's page (RAM role template). Azure, GCP and OCI onboarding mechanics are not publicly verifiable: Orca only publishes walkthrough videos, and the OCI page copies the Alibaba wording ("RAM Role", "role ARN"), so it is not treated as evidence of an OCI mechanism. B rests on AWS and Alibaba being keyless while Snyk, Cloudflare, Akamai and Terraform Cloud want static API tokens and Zscaler ZPA an OAuth client secret. If Azure or GCP turn out to take a client secret or service account key, the grade stays B; A would need every integration to be keyless.

Hygiene for any static credential the product still issues

✗ Expiry enforceable
Tokens can carry an expiration date, but the creation dialog has a "Never Expire" checkbox and no organization policy to forbid it or cap the lifetime is publicly documented. A changeable expiry is not an enforced one (same call as `elastic-cloud-api`).
  • support.expel.io checked 2026-10-22
    “Never Expire - select this checkbox.”
  • help.vanta.com checked 2026-10-22
    “We want to set the expiration date as not setting any is a security concern.”
  • docs.observeinc.com checked 2026-10-22
    “Name the new API token, for example, Observe-Lambda-Token, and select a desired expiration date.”
✗ Rotation via API
Not publicly verifiable. A list-tokens endpoint and an auth.tokens.write RBAC permission exist, but no public source documents creating or revoking API tokens through the API, and the Terraform provider has no token resource; every integration guide creates tokens in the console. Would pass with a citable create/revoke token endpoint.
  • truto.one checked 2026-10-22
    “Use this endpoint to retrieve a list of active authentication tokens associated with your Orca Security account.”
  • raw.githubusercontent.com checked 2026-10-22
    “"auth.tokens.write"”
✓ Scoped keys
Each token takes its own role (Viewer, Internal Viewer, custom roles) and can be scoped to specific resources or accounts, and a Service Token is not tied to a user, which the rubric counts as a purpose-built machine principal.
  • support.expel.io checked 2026-10-22
    “Service Token - select this checkbox (to prevent the token expiring with a user account).”
  • help.vanta.com checked 2026-10-22
    “Leave the Scope access to specific resources checkbox unchecked.”
  • explained.tines.com checked 2026-10-22
    “Determine the expiration date, role, and scope you wish to apply”
✗ Last-used visible
Not publicly verifiable: no public source shows a last-used timestamp on API tokens. Orca's docs may show one behind the login wall; a public citation would flip this check.
  • truto.one checked 2026-10-22
    “Use this endpoint to retrieve a list of active authentication tokens associated with your Orca Security account.”
✗ Leak revocation
Orca Security does not appear in GitHub's supported secret-scanning patterns table, so a leaked Orca API token is not reported to Orca.

Notes

One card for the Orca Cloud Security Platform (CSPM, CWPP, Shift Left, MCP server share one API token model). Orca's documentation portal is login-walled, which limits what can be cited: rotation API and last-used are failed as not publicly verifiable, and Azure, GCP and OCI onboarding are unverified. With only scoping passing, inbound is F; publishing a create/revoke token API, a last-used field and a max-lifetime policy would lift it to D. Inbound moves to B or A only with a federated login (GitHub Actions OIDC, cloud workload identity or bring-your-own issuer). Reviewer check: the AWS template evidence is a third-party copy of Orca's CloudFormation template, not an Orca-hosted page.

Badge

wif.tax grade F

[![wif.tax grade](https://wif.tax/badge/orca-security.svg)](https://wif.tax/p/orca-security/)