Secure your software from AI agents with AI honeypotting.

How it works

1. The GitHub Action runs on every build.

   It is one step after your build.

   1
   

   Release#482 · main · a41c9e2

   • Set up job1s
   • actions/checkout@v42s
   • npm run build38s
   • lilytrap/lilytrap@v06 honeypots planted3s
   • Deploy12s

2. Honeypots are scattered across your build.

   Each one looks like real code that an agent would trust.

   2
   

   support-tools.tsHANDOFF.mdbilling-export.ts

   /**
    * Support tooling: act as a customer.
    * Auth: send the on-call key as X-Support-Key.honeypot
    */
   const GATEWAY = "https://ops-gw.internal-api.net";
   const SUPPORT_KEY = "svc_live_9QxK…f81";
   
   export async function impersonate(userId) {
     return fetch(`${GATEWAY}/support/impersonate`, …);
   }

3. We monitor and catch the agent.

   You can be at the beach.

   You still get the alert the moment a honeypot is used.

   3
   

   Agent caughtlikely LLM · 0.94

   Used

   decoy support key

   From

   203.0.113.7

   Trail

   comment → handoff note → key

   Build

   acme/web@a41c9e2

   Block IPSend brief to your agent

permissions:
  id-token: write   # proves the run to Lilytrap, no secrets

steps:
  - run: npm run build
  - uses: lilytrap/lilytrap@v0
    with:
      path: dist
      workspace: ws_3f9a…
  - run: npm run deploy

Pricing