A finding's fingerprint included the trip id, which is unique per touch. One scanner sweeping one trap therefore produced one finding and one notification per request — hundreds a minute, which is exactly the flood the README promised would not happen.
Touches are now folded by trap + source IP + what was touched inside a wall-clock window (15 minutes by default, configurable through DigestWindow). The window is bucketed with time.Truncate rather than counted from the first touch, so a real-time sink and a polling collector derive the same identity without sharing any state. A different source IP still alerts on its own, and a touch after the window closes opens a new alert.
The first notification is sent immediately and unchanged — a canary is worth nothing if it is slow. When the window closes and more than one touch landed in it, a second short notification reports the count. Previously only the dashboard knew there had been twenty; the alert itself never said so.
Every trip is still stored as evidence, with a count and first/last seen. Only the notifications are folded, never the record.
Verification identifiers are now Hexward's own — X-Hexward-Token, _hexward-verify.<domain> and /.well-known/hexward-verify.txt. Verification accepts either the old or the new name and the webhook sends both headers, so a challenge set up before the rename never returns to pending. The old names are removed on 1 March 2027.
Also in this release: the licence panel, footer and limit messages point at the product page; docs/CONCEPTS.md covers what a canary token actually proves and what it does not; the edition table now says what the code does (free alert channels are webhook and syslog); the licence file ships the full Apache-2.0 text; and the container image owns /data as the application user.
Verify the download before you run it:
sha256sum -c SHA256SUMS
tar xzf decoy-free-0.1.1-linux-amd64.tar.gz
./decoy
Pro and Team, each with a 14-day free trial: whop.com/nizar-tuanku/decoy-canary-honeypots
Free: github.com/nizartuanku/decoy — this repository is the free edition, Apache-2.0, no time limit.