Bait files that warn you when someone uses your secrets

Prevention fails sometimes. A bait file makes the failure loud: it looks like exactly what a thief or a hijacked agent hunts for, and it reports the moment it is used.

   thief or rogue agent
          │  grabs the juicy file
          ▼
   ┌──────────────┐        used?        ┌───────────────┐
   │ .env.production│ ─────────────────▶ │ you get a mail │
   │  (a bait)     │   time · which bait │ within seconds │
   └──────────────┘    · who (a hint)    └───────────────┘
   nobody legitimate ever uses it → almost no false alarms

The idea

Attackers and rogue agents grab credentials fast and use them without reading much. A file called .env.production, a .npmrc with a token or an AWS credentials file is the first thing automated tooling goes for. If those files are fake, no normal user ever has a reason to use them. The first use is therefore a signal with almost no false alarms. This technique is widely known as a canary token or honeytoken.

How Dante's bait watch works

1. Turn it on. Type watch. Dante makes up its own random identity (like dante-1234). The one call that introduces it is shown as a command first and runs only after your yes.
2. Bind your mail once on a web page, through a one-time link that only your terminal showed. A proof mail arrives straight away, so you know the address works before any real incident. Check your spam folder if it does not show.
3. Lay bait. watch bait env (or mcp, npm, aws). Dante writes the bait file where you are and never overwrites an existing file.
4. Wait. Dante itself still sends nothing. Only a bait that is used calls our server, and then you get one mail, at most one per hour.

What the alert looks like

What the alert tells you

• the time and which bait was used;
• why it matters: what that bait would have given the person (database and API data, an agent's tools, the right to publish packages, a cloud account);
• a hint who used it (an AI agent tool, a package manager, a script, a browser, a scanner). It is a hint from the request, which can be forged, and the mail says so;
• what to do now.

What it cannot do

A bait warns you that something used a fake secret. It does not stop the intruder, and it cannot see attacks that never touch the bait. It complements, not replaces, removing real secrets and locking down SSH. If the watch runs out, baits stop reporting alerts; you get one mail (at most one a day) with the number of uses since then and a link to turn it back on.

Cost

The first month is free. After that it is 1.99 EUR for each further month, paid once per month through SumUp (not an automatic subscription). Details on the install and packs page.

Questions people ask

More

• AI agent security risks: seven ways an agent on your machine gets abusedPrompt injection, over-broad permissions, poisoned MCP tools, secrets in readable files, supply-chain malware that talks to your AI assistant.
• How to find leaked API keys and secrets on your own machineWhere keys hide (code, .env, Git history, shell history, cloud files), how to tell a normal private .env from a real leak, and how to check without ever printing the secret..
• Is my server hacked? How to check your own server for warning signsA practical checklist for a server you own: SSH settings, world-writable files, web shells, outdated PHP, unknown cron jobs and keys - and what a read-only check can and cannot prove..
• Install Dante in three minutes - and what the packs costStep-by-step install for Mac, Windows and Linux with one command, how to talk to Dante, the free and paid parts, and how updates and knowledge packs work.
• After the Hugging Face incidents: check your tokens and the models you downloadedWhat was reported about Hugging Face Spaces secrets and malicious models, what to rotate, why pickle files are risky, and how to check your own cache and agent config without sending anything anywhere..