canary token
A decoy marker used to detect information leakage. It carries no actual permissions, and its appearance in any unauthorized location—such as logs, email egress, or public scanning results—triggers a high-confidence alert, converting passive defense into active detection.
Timeline (last 90 days)
A canary token is a decoy marker that itself has no actual privileges, and once it appears in an unauthorized location it indicates that data has been read without authorization, so it can be used to proactively detect information leaks.
Each honeycrawlpot deployment can be configured with a unique canary token (such as LF-HONEYPOT-QONTO-01) that appears in the fake files and can be used to monitor in logs, SIEM, or scanner reports whether anyone has triggered the honeypot.
When designing a canary token, ensure the token is globally unique, indexable by logging systems, and not confused with the format of real secrets.
All Facts (3)
A canary token is a decoy marker that itself has no actual privileges, and once it appears in an unauthorized location it indicates that data has been read without authorization, so it can be used to proactively detect information leaks.
50%UnverifiedEach honeycrawlpot deployment can be configured with a unique canary token (such as LF-HONEYPOT-QONTO-01) that appears in the fake files and can be used to monitor in logs, SIEM, or scanner reports whether anyone has triggered the honeypot.
50%UnverifiedWhen designing a canary token, ensure the token is globally unique, indexable by logging systems, and not confused with the format of real secrets.
50%