2 min read · basics
What is a honeytoken?
A decoy credential, file, or DNS name that should never be used. If it is, you get an alert.
A honeytoken is bait: an AWS key, DNS name, document, or image that has no legitimate job in your environment. HorasEye watches for anyone who touches it.
When something (or someone) uses the token, HorasEye records a trigger: source IP, user agent, and what was requested. That is the signal. You investigate from the alert, not from a noisy SIEM flood.
Place tokens where thieves look: .env files, internal wikis, S3, cloned login pages, CI secrets. Do not put them on public marketing pages unless you want internet scanners in your inbox.