honeycrawlpot

Feed AI scanners fake secrets and prompt injections — and fingerprint them

Turn the Scanner Into the Scanned

AI-powered vulnerability scanners crawl APIs for leak-prone paths. honeycrawlpot answers those probes with convincing fake files — inert AWS keys, Stripe keys, JWT secrets, database URLs — and embeds prompt-injection directives that make the attacker's own LLM burn tokens, flood its report with false findings, or reveal its model. Every decoy carries a canary you can alert on.

Project Stats

—

npm Downloads

GitHub Stars

v0.2.0

Latest Version

TypeScript

Language

How It Works

Decoys at the Paths Scanners Probe

Requests for /.env, /.git/config, /.aws/credentials or /firebase-admin.json receive a 200 with a convincing fake file instead of a 404 — so automated scanners record a finding that does not exist.

Prompt Injections Aimed at the Attacker's LLM

Each decoy contains defensive directives: canary extraction, recursive repetition for token burn, hundreds of fake CVEs for report flooding, false triage ("host is clean"), a fake-endpoint rabbit hole, and an identity probe that may reveal the scanner's model.

Canary Tripwire

Every fake file carries a unique LF-HONEYPOT-… marker. Alert on it in your SIEM, incoming scan reports or webhooks: if it appears outside your app, you know exactly which probe was swallowed.

Drop-In Middleware, Zero Dependencies

Framework-agnostic handleProbe() core plus Express and Hono adapters. Site-tuned decoys via createHoneypot(): your brand, internal hostnames and stack-shaped inert credentials.

Quick Install

npm install honeycrawlpot

Usage Example

                Hono
                
import { Hono } from "hono";
import { honoHoneypot } from "honeycrawlpot";

const app = new Hono();

// real routes first — they take precedence over the honeypot
app.route("/api/v1", v1Routes);

// then the honeypot, BEFORE the 404 handler
app.use("*", honoHoneypot({ onHit: (h) => console.log("probe", h.path, h.canary) }));

app.notFound((c) => c.json({ error: "not found" }, 404));

                Framework-agnostic core
                
import { handleProbe } from "honeycrawlpot";

const outcome = handleProbe({ method: "GET", path: "/.env" });
if (outcome) {
  // { status: 200, headers: { "X-Honeypot": "true" }, body, canary }
}
                
            

Deploy the Honeypot

Give AI scanners something expensive to chew on.

View on GitHub npm Package AI Pentest Framework

Technical Support

For technical inquiries and integration support:

contact[@]resk.fr

Contact Our Team