Canary Credentials: The Smoke Detector

Three well-known projects - Trivy, KICS, LiteLLM - were compromised through a single supply chain attack. Somebody injected malicious code into the pipeline, and that code ran quietly across hundreds of organisations. No alert. No detection. Nobody noticed.

Do you know the maddest part? The solution that would have caught it costs nothing and takes half an hour to put in place.

Canary credentials

The idea is almost painfully simple. You put fake credentials inside the CI/CD pipeline. A username and password that look entirely real. But they are wired to nothing real. They just sit there and wait.

The moment somebody - or something - tries to use them, you get an alert. Because no legitimate process should ever touch them. No script, no tool, no human. If anything reaches for them, it means one thing: somebody stole them from your pipeline.

It is exactly like a smoke detector. It does not prevent the fire. It does not put it out. But it warns you while you can still get out.

In the case of Trivy and KICS, the malicious code running in the pipeline was looking for precisely this - secrets, tokens, credentials. If canary credentials had been there, the alert would have fired the moment the code tried to send them out. Before the real damage happens.

Nobody does it

I see organisations investing millions in SAST and DAST and SCA and SBOM and a million other tools with lovely acronyms. And nobody puts fake credentials in the pipeline. Nobody.

It is like buying a 50,000-shekel alarm system and forgetting to lock the door.

I am not saying it replaces anything. I am saying it is the cheapest, simplest, most under-used layer you can add.

If your CI/CD pipeline does not contain at least one canary credential, you are blind. Not partially. Completely.

I first shared a version of this as a LinkedIn post on 2026-06-09. It is republished here, lightly edited, so it is easier to find and reference. — Erez Metula

Keep reading