trappsec

trappsec

trappsec is an open-source framework that helps developers detect attackers who probe API business logic. By embedding realistic decoy routes and honey fields that are difficult to distinguish from real API constructs, attackers are nudged to authenticate — converting reconnaissance into actionable security telemetry.

Built for the 1% of people who actually look at their security alerts, and the 99% who just like the idea of having them.

Read the Docs • Ultra Quickstart • Threat Model • Production

---

Core Concepts

• Decoy Routes: These are "ghost" endpoints that sit outside your real logic but look authentic. By planting dummy references in your client-side code, you can bait attackers into hitting these traps, allowing you to monitor their behavior via custom static or dynamic responses that adapt to the authentication status.

• Honey Fields: Non-functional parameters embedded within legitimate API endpoints that act as invisible tripwires. You can bait attackers by including them as hidden form fields with static values or leveraging existing "read-only" attributes that appear in GET responses as honey fields that trigger alerts if an attacker attempts to modify them via POST or PUT requests.

• Identity Attribution: Framework hooks allow you to link a request to an authenticated user identity. You can also map traps to a specific intent (Privilege Escalation, Reconnaissance etc). Put together, you get high-fidelity alerts that security teams can respond to quickly and more effectively.

---

Best Practices

• Require Authentication: In an internet that is mostly harmless but increasingly full of people and scanners (mostly scanners) poking things they shouldn't, you don’t want to get buried with noise. Use unauthenticated template responses like (401, Unauthorized) to guide them to probe with authentication.

• Blend In: A trap should look exactly like a normal part of your API. A good trap should look like a mundane, standard - perhaps even tedious part of your API. If it looks "too good to be true", attackers will ignore it. Design traps to catch people trying to understand or manipulate your business logic.

---

Alerting

trappsec can integrate directly into your existing workflows. Events are written to your standard logging handlers by default, but can be configured to also integrate into OpenTelemetry for observability or Webhooks to trigger automated responses or notify security teams.

---

Let Your Coding Agent Do It

The add-deception agent skill turns your coding agent into a deception engineer for your own app. It:

• studies your API conventions and frontend code;
• designs decoy routes and honey fields that match them;
• plants lures in the frontend that look like your team wrote them;
• verifies that every trap fires and that no real user can ever trigger one.

Claude Code:

/plugin marketplace add trappsec-dev/trappsec
/plugin install trappsec@trappsec

Then ask it to add deception to this app, or run /trappsec:add-deception.

Other agents that support Agent Skills: copy plugins/trappsec/skills/add-deception into your agent's skills directory.

---

Supported Frameworks

Language	Framework
Python	Flask
	FastAPI
	Starlette
	Litestar
	Django
	Sanic
	Tornado
Node.js	Express
	NestJS
	Fastify
	Hapi
	Koa
	Hono
Go	net/http
	Gin
	Echo
	chi, gorilla/mux and other http.Handler routers

Missing your favorite framework? Raise a request here.

---

Support

Community support is available via GitHub issues and discussions.
For commercial support or services, email [email protected].