Real credentials that grant nothing, placed where intruders and their agents go looking. The first use tells you where and when.
GITLAB_TOKEN=glpat-xxxxxxxxxxxxxxxxxxxx AWS_ACCESS_KEY_ID=AKIAxxxxxxxxxxxxxxxx AWS_SECRET_ACCESS_KEY=xxxxxxxxxxxxxxxxxxxxxxxxxx # rotated 04-02 — do not commit
Threat actors now hand the tedious part to agents: sweep a foothold for credentials, try each one, map what it opens. A cloud key or a git token is the prize, because infrastructure and source are where the next moves come from.
They enumerate. Every file, variable and log that might hold a secret gets read, so a decoy in any of them gets read too.
They validate. A found credential is tried against its platform to see what it opens. That single call is the alert.
They are fast. Minutes from foothold to harvest, which is why the signal has to come from the first touch, not from a pattern learned over weeks.
A CI variable nothing legitimate reads. The pipeline runs exactly as before; the first job, script or person that does read it has told you where they are.
Once a credential is in hand, everything an intruder does looks like ordinary work. Repos get cloned, buckets get listed, releases get published. No rule fires, because no rule was broken.
A workflow let untrusted pull-request code run with credentials in reach. The alert that told them came from a decoy token.
Malicious releases pushed straight to PyPI after a security scanner inside the CI pipeline was compromised.
Malicious releases published from the project's own trusted workflow, via a cache-poisoning chain in GitHub Actions. No password was stolen.
A real GitLab token or AWS key, minted on the platform itself, with access to next to nothing.
Put it where someone would go looking, and record the placement in your own words. That is what the alert will name.
The first use emails your team the placement, the time and the source address. The decoy's page keeps every use after that.
Where attackers and their agents search first. Your team decides which are in scope.
A decoy has no legitimate use, so if it fires, someone found it. No tuning, no baseline.
A decoy is a string. No agents on endpoints, no access to your accounts, no change window.
An alert that names a placement and a time reads the same to the engineer triaging it and to the board asking what was touched.
The free plan needs no card. Put a GitLab token and an AWS key in one repo this week; if nothing fires, you have lost a week and learned where your blind spots are not. Want us on the call when the first alert lands? See the plans that come with our team.