Supply chain

Supply-chain secret detection with decoy tokens

Attackers and secret scanners hunt npm tokens, PyPI keys, Docker logins, and GitHub PATs in repos and CI. Plant HorasEye decoys in those same shapes and get an alert when they are used.

Supply-chain attacks often start with a leaked credential, not a malicious maintainer. A backup .env, an old GitHub Actions secret, or a developer laptop image is enough. Supply-chain secret detection here means honeytokens that look like the tokens your build system actually uses.

HorasEye generates decoy GitHub PATs, npm publish tokens, PyPI tokens, Docker registry credentials, and Stripe sk_live_-shaped keys. Typical detection is a DNS callback when the embedded hostname is resolved, the same pattern you would use for a Slack-style API token.

Where these decoys belong

  • .npmrc and .pypirc backups
  • Monorepo .env.production.backup files
  • CI secret stores and "example" workflow files that still look copy-pasteable
  • Docker config JSON in home-directory tarballs

Combine with cloud keys

A scraped secrets file often contains AWS keys next to registry tokens. Pair these decoys with an AWS IAM honeytoken so use of either class of secret is visible. For the broader category, see what honeytokens are.

FAQ

Supply-chain decoy questions

What these tokens detect, and what they do not replace in a secure publishing pipeline.

You plant decoy package-registry and CI credentials next to real-looking configs. If a scanner, insider, or stolen laptop uses them, the DNS or HTTP callback tells you the secret left the place you planted it.

Deploy your first decoy

Create an account, pick a honeytoken type, and plant it where attackers hunt for secrets. Most teams do this in about two minutes.

Get started freeView pricingContact us →

Related guides