Changelog Master Feed
Changelog Master Feed
Changelog Media
Canary tokens and digital tripwires (Changelog Interviews #683)
2 hour 6 minutes Posted Jul 21, 2026 at 7:00 pm.
Welcome back Haroon!
Fifty people, zero outbound sales, 22.5M ARR
Honeypots inside the network, not research toys
The AWS API key attackers can't resist
Hosting Canarytokens free for the world
Ten years without a price increase
A Python shop and a self-hosted token server
Real credit card as a tripwire
Dragging attacks into molasses
Demo: Synology NAS in one click (watch on YouTube)
WireGuard tokens, QR codes, and dumpster divers
Sponsor: Buildkite
Securing the canaries themselves
$7.5K to start, million-dollar customers
Airport ads, padel, and quality swag
Open Canary, the free little brother
Self-hosting and sovereignty in the agent era
Divergent codebases and DNS-tunneled updates
A first acquisition and open source PRs
Breadcrumbs lead attackers to canaries
Tokens in binaries, catching reverse engineers!!
Sponsor: WorkOS
Why Python still pays the bills
Don't overthink it. Just deploy.
GPL, clean rooms, and playing with other vendors
Growth without jet fuel
canary.love, law enforcement, NVIDIA, and Grafana
Wrapping up...canary.tools and canarytokens.org
0:00
2:06:48
Download MP3
Show notes
Haroon Meer is back! Haroon is the Founder of Thinkst, the ~50-person bootstrapped company behind Canary and Canarytokens — honeypots and tripwires you sprinkle inside your network and forget about until an attacker touches one. We talk about the AWS API key token attackers just can't resist trying, the real credit card token backed by an actual bank partnership, Breadcrumbs (their brand-new feature that leads intruders straight to your canaries), a live demo where a hardware Canary becomes a Synology NAS in one click, and how a company with zero outbound sales and no price increase in ten years quietly passed $22.5 million in ARR.