Tachyon Canaries

Plant decoy keys. Get alerted when they’re used. Place realistic credentials in .env files, developer machines, CI/CD, or AI-agent contexts. Each decoy authenticates only against an isolated system Tachyon controls, so it cannot touch your infrastructure.

Get started

The Canaries app runs at tripwire.so.

.env

# A decoy sits among real config, where an intruder looks first.

# Its only home is a Tachyon-controlled system — any use fires an alert.

NODE_ENV=production

DATABASE_URL=postgres://[email protected]:5432/app

REDIS_URL=redis://cache.internal:6379

AWS_ACCESS_KEY_ID=AKIA2E4CANARYJH7QX4

AWS_SECRET_ACCESS_KEY=wJalrXU/canary/decoy/no+infrastructure+access

AWS_REGION=us-east-1

Isolated credentials

A canary resembles the credential type selected for its placement. It is registered only with a Tachyon-controlled system and carries no permission in your cloud account, source control, application, or data. A successful use identifies access to the planted value.

Alert evidence

When a decoy is presented, Tachyon records the service, decoy identifier, attempted action, source IP, and timestamp. The event is sent by email and is available through the web console or CLI.

alert.json

{

"service": "AWS",

"decoy": "AKIA...CANARY",

"attempted_action": "GetCallerIdentity",

"source_ip": "<source_ip>",

"timestamp": "<event_time>"

}

Credential types

AWS access keys, GCP service credentials, Azure client secrets, GitHub tokens, Terraform cloud credentials, Anthropic API keys, OpenAI API keys, Slack tokens, Stripe secret keys, SendGrid API keys, database connection credentials, and JWT signing secrets.

Place your first decoy

Choose a credential type and register it from the Canaries app at tripwire.so.

Get started