📂 Honey Code Repository

Fake GitHub/GitLab repos with embedded honeytokens.

→ Explore in ATT&CK matrix (2 mappings) Deployment detail

What it is

Create fake internal repositories with attractive names (infrastructure-secrets, prod-terraform-state) containing planted honeytokens. When cloned or accessed, the embedded tokens alert on use.

Implementation requirements

GitHub/GitLab organization with repo creation permissions
Realistic commit history (use scripts to generate months of fake commits)
Embedded honeytokens: AWS keys, API tokens, database connection strings
GitHub audit log monitoring for clone/access events
Rollback: Archive or delete the repository and revoke its embedded tokens; check for forks and mirrors.
Upkeep: Add commits occasionally so it does not look abandoned. Monthly proof-of-life clone.

Technologies

AWSCI/CD

ATT&CK coverage 2

Technique	Tactic	Status	Confidence	Tier
T1213.003 Code Repositories	Collection	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (4 sources) GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1213.003 Code Repositories as an adversary behaviour.
T1552.001 Credentials In Files	Credential Access	confirmed	strong	T2
↳ Detection point: the decoy fires at a later step of the attack
↳ Evidence (5 sources) CloudKeys in the Air: Tracking Malicious Operations of Exposed IAM Keys — AWS keys planted on GitHub were harvested and used by attackers within minutes. 2023 Honeypotting in the Cloud Report — AWS keys planted in GitHub, S3, ECR, EBS and other resources were found and used; GitHub keys within 2 minutes. GitGuardian Honeytoken — core concepts — Production honeytokens placed in code repositories, CI/CD, Docker images, Jira, Confluence and Slack alert when used. AWS API Keys token — Canarytokens documentation — A fake AWS key alerts on any use through the AWS API. MITRE ATT&CK Enterprise v20.0 — ATT&CK v20 documents T1552.001 Credentials In Files as an adversary behaviour.

Evidence

SaaS Attack Techniques — Push Security industry
MITRE ATT&CK Enterprise v20.0 — MITRE 2026 standard

Research basis: Push Security, "SaaS Attack Techniques" (Industry Research). Thinkst Canaries documentation on code repository tokens.