{"slug": "canarytokens", "name": "Canarytokens", "category": "security", "category_name": "Security and passwords", "description": "", "recommenders": 4, "commenters": 5, "warners": 0, "score": 4.274, "rising": 3.67, "first": "2026-04-26", "latest": "2026-10-24", "why": "That\u2019s a really good idea, I love that they even do fake bank cards.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 5, "neutral": 1, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 0, 1, 0, 0, 0, 0, 0, 4], "listed": true, "loved": [], "caveat": "", "short_quote": "That\u2019s a really good idea, I love that they even do fake bank cards.", "kind": "", "icon": true, "domain": "canarytokens.org", "github_repo": null, "official_url": "https://canarytokens.org", "pricing": "", "aliases": ["Canarytokens", "Canary Tokens"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 803068416, "item_id": 50191776, "url": "https://news.ycombinator.com/item?id=50191776", "by": "radku", "date": "2026-10-22", "version": null, "stance": "recommend", "quote": "Canary token is great to tell you've been hacked.", "excerpt": "Canary token is great to tell you've been hacked. There are ways to try to prevent this from happening in a first place. I wrote kow (keys-on-the-wire) to fix this. Apps only see placeholder tokens. The proxy injects real key from the vault into outbound requests for allowed hosts. Author here. Apache-2.0. [1] https://keysonthewire.com [2] https://github.com/inflightsec/keys-on-the-wire", "context": "", "use_case": "", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 803009664, "item_id": 50188104, "url": "https://news.ycombinator.com/item?id=50188104", "by": "maxmcl12", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "You can totally host it yourself! https://github.com/thinkst/canarytokens", "excerpt": "You can totally host it yourself! https://github.com/thinkst/canarytokens", "context": "", "use_case": "tripwire / alerting", "switched_from": "", "story": "Canary Tokens"}, {"id": 803008512, "item_id": 50188032, "url": "https://news.ycombinator.com/item?id=50188032", "by": "MisterMunchkin", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "That\u2019s a really good idea, I love that they even do fake bank cards.", "excerpt": "That\u2019s a really good idea, I love that they even do fake bank cards. I feel like a self-hosted version would be better though. Having to phone home to their servers could give the game away.", "context": "", "use_case": "honeytoken intrusion detection", "switched_from": "", "story": "Canary Tokens"}, {"id": 802979392, "item_id": 50186212, "url": "https://news.ycombinator.com/item?id=50186212", "by": "bstsb", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "i've been using canarytokens for years!", "excerpt": "this is absolutely not a given, i've been using canarytokens for years! blog posts date back to at least 2015: https://leonjza.github.io/blog/2015/09/10/canarytokens---the-maybe-not-so-obvious/", "context": "", "use_case": "canary tokens security", "switched_from": "", "story": "Canary Tokens"}, {"id": 802958128, "item_id": 50184883, "url": "https://news.ycombinator.com/item?id=50184883", "by": "linsomniac", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "Just going to remind you all that https://canarytokens.org/ exists.", "excerpt": "Just going to remind you all that https://canarytokens.org/ exists.", "context": "", "use_case": "", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["honeytoken breach detection", "tripwire / alerting", "honeytoken intrusion detection", "canary tokens security", "aws credential tripwire"], "compared": [], "makers": [{"id": 803006096, "item_id": 50187881, "url": "https://news.ycombinator.com/item?id=50187881", "by": "maxmcl12", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "We also think they\u2019re one of the few things available that work well for agentic threats.", "excerpt": "Thanks! We also think they\u2019re one of the few things available that work well for agentic threats. You might find some recent work we did on agent deception interesting as well: https://blog.thinkst.com/2026/09/getting-agents-to-tell-on-themselves.html", "context": "", "use_case": "", "switched_from": "", "story": "Canary Tokens"}], "threads": [{"url": "https://news.ycombinator.com/item?id=50185630", "title": "Canary Tokens", "mentions": 4}, {"url": "https://news.ycombinator.com/item?id=50181114", "title": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=50224916", "title": "Show HN: Steal My Bitcoin", "mentions": 1}, {"url": "https://news.ycombinator.com/item?id=47911524", "title": "An AI agent deleted our production database. The agent's confession is below", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {}, "2026-04": {"recommend": 1}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {}, "2026-09": {}, "2026-10": {"recommend": 4, "neutral": 1}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 803614688, "item_id": 50225918, "url": "https://news.ycombinator.com/item?id=50225918", "by": "LPisGood", "date": "2026-10-24", "version": null, "stance": "neutral", "quote": "There are entire businesses set up to help enterprises do this at scale", "excerpt": "There are entire businesses set up to help enterprises do this at scale: https://canarytokens.org/nest/", "context": "", "use_case": "Honeytoken breach detection", "switched_from": "", "story": "Show HN: Steal My Bitcoin"}, {"id": 803068416, "item_id": 50191776, "url": "https://news.ycombinator.com/item?id=50191776", "by": "radku", "date": "2026-10-22", "version": null, "stance": "recommend", "quote": "Canary token is great to tell you've been hacked.", "excerpt": "Canary token is great to tell you've been hacked. There are ways to try to prevent this from happening in a first place. I wrote kow (keys-on-the-wire) to fix this. Apps only see placeholder tokens. The proxy injects real key from the vault into outbound requests for allowed hosts. Author here. Apache-2.0. [1] https://keysonthewire.com [2] https://github.com/inflightsec/keys-on-the-wire", "context": "", "use_case": "", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 803009664, "item_id": 50188104, "url": "https://news.ycombinator.com/item?id=50188104", "by": "maxmcl12", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "You can totally host it yourself! https://github.com/thinkst/canarytokens", "excerpt": "You can totally host it yourself! https://github.com/thinkst/canarytokens", "context": "", "use_case": "tripwire / alerting", "switched_from": "", "story": "Canary Tokens"}, {"id": 803008512, "item_id": 50188032, "url": "https://news.ycombinator.com/item?id=50188032", "by": "MisterMunchkin", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "That\u2019s a really good idea, I love that they even do fake bank cards.", "excerpt": "That\u2019s a really good idea, I love that they even do fake bank cards. I feel like a self-hosted version would be better though. Having to phone home to their servers could give the game away.", "context": "", "use_case": "honeytoken intrusion detection", "switched_from": "", "story": "Canary Tokens"}, {"id": 802979392, "item_id": 50186212, "url": "https://news.ycombinator.com/item?id=50186212", "by": "bstsb", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "i've been using canarytokens for years!", "excerpt": "this is absolutely not a given, i've been using canarytokens for years! blog posts date back to at least 2015: https://leonjza.github.io/blog/2015/09/10/canarytokens---the-maybe-not-so-obvious/", "context": "", "use_case": "canary tokens security", "switched_from": "", "story": "Canary Tokens"}, {"id": 802958128, "item_id": 50184883, "url": "https://news.ycombinator.com/item?id=50184883", "by": "linsomniac", "date": "2026-10-21", "version": null, "stance": "recommend", "quote": "Just going to remind you all that https://canarytokens.org/ exists.", "excerpt": "Just going to remind you all that https://canarytokens.org/ exists.", "context": "", "use_case": "", "switched_from": "", "story": "Compromised LiteLLM 1.107.0 on PyPI Installs a Credential Stealer and Backdoor"}, {"id": 766650288, "item_id": 47915643, "url": "https://news.ycombinator.com/item?id=47915643", "by": "linsomniac", "date": "2026-04-26", "version": null, "stance": "recommend", "quote": "This is your reminder to set up canary tokens", "excerpt": "This is your reminder to set up canary tokens: https://canarytokens.org/nest/ I had a token I set up 3 years ago for AWS that I hadn't used. I was recently doing something with Claude and was asking it to interact with our AWS dev environment. I was watching it pretty closely and saw it start to struggle (I forget what exactly was going on), and I was >50% likely it was going to hit my canary token. Sure enough, a fe", "context": "", "use_case": "AWS credential tripwire", "switched_from": "", "story": "An AI agent deleted our production database. The agent's confession is below"}]}