Skip to content

Releases: nizartuanku/decoy

Release list

Decoy 0.1.1 — a burst of touches is one alert, and the alert says how many

Decoy 0.1.1 — a burst of touches is one alert, and the alert says how many Latest
Latest

Choose a tag to compare

View all tags
@nizartuanku nizartuanku released this 07 Sep 03:11
v0.1.1
370349b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

A finding's fingerprint included the trip id, which is unique per touch. One scanner sweeping one trap therefore produced one finding and one notification per request — hundreds a minute, which is exactly the flood the README promised would not happen.

Touches are now folded by trap + source IP + what was touched inside a wall-clock window (15 minutes by default, configurable through DigestWindow). The window is bucketed with time.Truncate rather than counted from the first touch, so a real-time sink and a polling collector derive the same identity without sharing any state. A different source IP still alerts on its own, and a touch after the window closes opens a new alert.

The first notification is sent immediately and unchanged — a canary is worth nothing if it is slow. When the window closes and more than one touch landed in it, a second short notification reports the count. Previously only the dashboard knew there had been twenty; the alert itself never said so.

Every trip is still stored as evidence, with a count and first/last seen. Only the notifications are folded, never the record.

Verification identifiers are now Hexward's own — X-Hexward-Token, _hexward-verify.<domain> and /.well-known/hexward-verify.txt. Verification accepts either the old or the new name and the webhook sends both headers, so a challenge set up before the rename never returns to pending. The old names are removed on 1 March 2027.

Also in this release: the licence panel, footer and limit messages point at the product page; docs/CONCEPTS.md covers what a canary token actually proves and what it does not; the edition table now says what the code does (free alert channels are webhook and syslog); the licence file ships the full Apache-2.0 text; and the container image owns /data as the application user.

Verify the download before you run it:

sha256sum -c SHA256SUMS
tar xzf decoy-free-0.1.1-linux-amd64.tar.gz
./decoy

Pro and Team, each with a 14-day free trial: whop.com/nizar-tuanku/decoy-canary-honeypots

Free: github.com/nizartuanku/decoy — this repository is the free edition, Apache-2.0, no time limit.

Assets 4
Loading

v0.1.0

v0.1.0

Choose a tag to compare

View all tags
@nizartuanku nizartuanku released this 21 Aug 23:34
v0.1.0
a0fa010

Decoy v0.1.0

Self-hosted canary tokens & honeypots: web/URL tokens, document beacons (docx/xlsx/pdf), TCP honeypot listeners, DNS tokens and fake cloud credentials — alerts the moment anything is touched.

This is the free edition, built from this repository with an empty license issuer key — it has no license activation. Free-tier limits: 3 tokens + 1 honeypot (advanced traps: Pro/Team). Pro and Team tiers (higher limits, delivered binaries) are available at whop.com/nizar-tuanku/decoy-canary-honeypots.

Install

tar -xzf decoy-free-0.1.0-linux-amd64.tar.gz
./decoy

Dashboard: http://127.0.0.1:8424 — single binary, SQLite storage in the working directory, no telemetry, nothing leaves your network.

Or build from source (Go 1.24+, CGO required for the SQLite driver):

go build ./cmd/decoy

Integrity

Verify the download:

sha256sum -c SHA256SUMS

SHA-256: 9617bb5fc80baaea58c1c5ea618de418845e2d4d07499c53a6d46bb6f389c02c

Feedback

Run it in a lab first. Bug reports and lab feedback via GitHub Issues are very welcome.

Loading