A small tripwire for files that should stay untouched.
Creates and watches canary files for modification, movement, or deletion and can send generic webhook events.
python src/honeyfile.py create ./important-record.txt
python src/honeyfile.py watch ./important-record.txtFor a global honeyfile command, run python -m pip install ..
Run the command with --help for every option. The tool works locally, collects no telemetry, and supports machine-readable output where applicable.
- Local first. Host data stays on the host unless you explicitly configure a webhook.
- Safe by default. Inspection is read-only and mutation requires a deliberate command.
- Small contract. The tool solves one defensive job and reports its limits plainly.
- Scriptable. Stable exit codes and structured output make automation practical.
The initial release targets Linux. Portable behavior is also tested on Windows where the underlying operating-system facilities allow it. See the threat model for trust boundaries and non-goals.
This repository uses Python and the standard library only. Version 0.1 detects replacement, content changes, metadata changes, and deletion. Read-access detection is not claimed on platforms that cannot provide it reliably.
python -m compileall -q src
python -m unittest discover -s tests -vMIT © Dispersal Wolves.