Tripwire
Plant decoy keys. Get alerted when they’re used. Place realistic credentials in .env files, developer machines, CI/CD, or AI-agent contexts. Each decoy authenticates only against an isolated system Tripwire controls, so it cannot touch your infrastructure.
Free tier: unlimited decoys, email alerts, web console, and CLI.
# A decoy sits among real config, where an intruder looks first.
# Its only home is a Tripwire-controlled system — any use fires an alert.
NODE_ENV=production
DATABASE_URL=postgres://[email protected]:5432/app
REDIS_URL=redis://cache.internal:6379
AWS_ACCESS_KEY_ID=AKIA2E4TRIPWIREJH7Q
AWS_SECRET_ACCESS_KEY=wJalrXU/tripwire/decoy/no+infrastructure+access
AWS_REGION=us-east-1Isolated credentials
A Tripwire decoy resembles the credential type selected for its placement. It is registered only with a Tripwire-controlled system and carries no permission in your cloud account, source control, application, or data. A successful use identifies access to the planted value.
Alert evidence
When a decoy is presented, Tripwire records the service, decoy identifier, attempted action, source IP, and timestamp. The event is sent by email and is available through the web console or CLI.
{
"service": "AWS",
"decoy": "AKIA...TRIPWIRE",
"attempted_action": "GetCallerIdentity",
"source_ip": "<source_ip>",
"timestamp": "<event_time>"
}Credential types
AWS access keys, GCP service credentials, Azure client secrets, GitHub tokens, Terraform cloud credentials, Anthropic API keys, OpenAI API keys, Slack tokens, Stripe secret keys, SendGrid API keys, database connection credentials, and JWT signing secrets.