From the Usual kitchen / Bait
Poison the .env scanners.
Bots ask every website for its secrets. Bait answers with a fake .env in which every credential is unique, so when one comes back you know who scraped it, who used it, and how fast.
Across our own sites, scanners ask for secrets thousands of times a week.
01 / How it works
Like a 409A with a different number for every reader.
Each fake credential is sealed with the scanner's address, network and country, and with which file and which line it came from. The credentials that matter point back at your own site: an admin URL, an internal API token, a git remote, a database password. When any of them shows up in a later request, Bait opens it, answers 401, and records the scrape, the use, and the time between them.
Nothing is stored when bait is handed out. The credential carries its own history, so Bait needs no database to catch a thief. The database is only for the leaderboard.
02 / Put it on your site
One file. Your agent can do it.
Paste this into the coding agent that works on your website.
Or do it by hand
Cloudflare Worker: use bait.js as the Worker, route it at example.com/*, set a BAIT_SECRET, and optionally bind a D1 database as BAIT_DB for a leaderboard. Node: app.use(baitMiddleware(createBait({ secret }))). The full guide, including verification and removal, is at /bait/install.
03 / The fine print
What it does and doesn't do.
Bait only answers requests sent to your own site. It never contacts the scanners, publishes no IP addresses, and fails open: if it breaks, your site serves the request as usual.
Stripe, OpenAI, GitHub and SendGrid keys in the bait look real, but they get tested at those companies, where you can't see it. To catch AWS keys, add one from canarytokens.org.