> ## Content Index
> Fetch the complete content index at: https://securinglaravel.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# Security Tip: Canary Tokens
- URL: https://securinglaravel.com/security-tip-canary-tokens/
- Published: 2022-12-16T00:00:53.000Z
- Updated: 2025-01-07T05:38:37.000Z
- Description: [Tip#31] These are my favourite simple security trick to let you know if someone is poking around in your stuff.
- Author: Stephen Rees-Carter
- Tags: Security Tips, Secrets, Canary Tokens

[Canary Tokens](https://canarytokens.org/?ref=securinglaravel.com) are a free service provided by [Thinkst Canary](https://canary.tools/?ref=securinglaravel.com) that provide an “*insanely easy-to-use honeypot solution that deploys in just 3 minutes.*”

The way they work is incredibly simple:

1. You generate a new token on their website.
2. You put the token somewhere
3. A hacker finds the token, interacts with it, and you get an alert!  
*(Most of the time, the hacker won’t even know they’ve triggered an alert!)*

There are a lot of different tokens available to be generated, so you can usually find one that suits your use case.

The token types include:

- DNS / hostname
- AWS keys
- Windows Command
- Word Document
- QR Code
- MySQL Dump *(this is great for your* `'database'` *folder!)*
- URL Loaded
- URL Redirects
- PDF
- Email address

> Every time I set up a new Laravel app, I **always** generate a couple of tokens and scatter them around my repo and production server(s). The `.env.example` file is fantastic for storing Canary Tokens, because they’ll be stored in the repo and easily findable by anyone snooping around in your code. I’ve also got a few hiding on my laptop. 😉

Let’s walk through a simple example: generating AWS keys.

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com-2fpublic-2fimages-2fbbac7bff-7d06-4880-9cf1-d1adbd27a197_720x453.png)

Step One: Generating a new set of AWS keys on canarytokens.org.

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com-2fpublic-2fimages-2f20178229-c4ea-493f-ae30-d2687b4ca051_713x916.png)

Step Two: The generated AWS keys for my Canary Token.

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com-2fpublic-2fimages-2fbe2f597c-9afd-4f72-8214-db118ec28f75_573x111.jpg)

Step Three: Laravel .env.example file with the generated AWS Keys Canary Token.

Step Four: wait for someone to go snooping around!

For this example, I’ve run [TruffleHog](https://github.com/trufflesecurity/trufflehog?ref=securinglaravel.com) on my codebase and it’s found some matches:

```
Found verified result 🐷🔑
Detector Type: AWS
Decoder Type: PLAIN
Raw result: AKIAYVP4CIPPOYTRDREA
File: .env.example
```

And I just received an email:

![](https://storage.ghost.io/c/d9/0d/d90de76f-6031-4e2c-85b8-3447a38c4992/content/images/image/fetch/f_auto,q_auto:good,fl_progressive:steep/https-3a-2f-2fbucketeer-e05bbc84-baa3-437e-9518-adb32be77984.s3.amazonaws.com-2fpublic-2fimages-2fa1816aab-c0e5-434a-a5c9-d74a8375b4c3_678x680.png)

Canary Token Alert email reporting which token was triggered, from what IP, and method used.

It really is that simple.

---

***If you found this security tip useful,*** [***subscribe***](#/portal/signup) ***to get weekly*** [***Security Tips***](https://securinglaravel.com/tag/tips/) **straight to your inbox.* Upgrade to a* [*premium subscription*](#/portal/signup) *for exclusive monthly* [*In Depth articles*](https://securinglaravel.com/tag/in-depth/)*, or drop a coin in the* [*tip jar*](#/portal/support) *to show your support.*

*When was the last time you had a penetration test? Book a* [*Laravel Security Audit and Penetration Test*](https://stephenreescarter.net/laravel-security-audits-and-pentesting/?utm%5Fsource=securinglaravel.com)*, or a budget-friendly* [*Security Review*](https://stephenreescarter.net/laravel-security-reviews/?utm%5Fsource=securinglaravel.com)*!* 

*You can also connect with me on* [*Bluesky*](https://bsky.app/profile/valorin.bsky.social?ref=securinglaravel.com)*, or* [*other socials*](https://pinkary.com/@valorin?ref=securinglaravel.com)*, and check out* [*Practical Laravel Security*](https://practicallaravelsecurity.com/?utm%5Fsource=securinglaravel.com)*, my interactive course designed to boost your Laravel security skills.*