{"repo":"dweinstein/canary","free":true,"listed":false,"github":"https://github.com/dweinstein/canary","clone":"git clone https://github.com/dweinstein/canary.git","description":"Tiny filesystem honeypot for macOS. Mounts fake secret files (.env, id_rsa, credentials.json) via WebDAV (no root) or NFS (root) — any access triggers an alert. Zero dependencies, pure Go stdlib.","language":"Go","stars":95,"topics":["developer-tools","filesystem","honeypot","supply-chain","security"],"license":"GPL-3.0","category":"security-tools","readme_excerpt":"canary A filesystem honeypot for macOS. Plants fake secret files ( .env , id rsa , credentials.json , etc.) at mount points you choose. Any process that reads these files triggers an immediate alert — because nothing legitimate should ever touch them. The idea: if malware, a rogue script, or an attacker with shell access starts scanning your home directory for credentials, the canary trips before they find anything real. How it works The tool runs a small server (WebDAV or NFS) that serves a virtual directory of fake-but-realistic secret files. It mounts this directory at a path you specify (e.g., /.secrets.d ). Every file access passes through the server, which logs the operation and fires a macOS notification. There are no real files on disk. The mount point is a virtual filesystem backed by your server process. Nothing persists if the server stops. Install Download the binary (macOS arm64): Or build from source: Quick start That's it. The directory /.secrets.d now contains bait files. Open another terminal and try: You'll see alerts in the canary terminal and get a macOS notification with a sound. Ctrl+C to stop. The mount is removed automatically. Two modes WebDAV (default) NFS --- --- --- Root required No Yes Mount type in mount output webdav nfs (blends in) Server visible to attacker Yes (same UID) No (runs as root) Attacker can kill/unmount Yes No Multiple mount points Yes One per instance WebDAV mode (default) No root required. Runs entirely as your user — no sudo, no","default_branch":null,"files":null,"tree":[],"storefront":"/r/dweinstein","claimed":false,"request_supported":{"post":"https://gitbuyer.com/r/dweinstein/canary/request-supported","requests":0},"note":"indexed from public GitHub; nothing is for sale on this page. Clone it from GitHub. Paid listings live at /search."}