krain
The honeypot solo devs can actually run and maintain
9 followers
The honeypot solo devs can actually run and maintain
9 followers
Krain is a lightweight open-source honeypot built for solo devs and small teams, not SOC teams. Host it once next to your real site and let it take the hits instead. It fakes an SSH login, a Grafana, and a full security console with PDFs and admin logins that lead nowhere. Touch the wrong file and you walk off with a planted AWS key that goes nowhere real. Scanners get stuck in tarpits: slow responses, endless directory listings, gzip bombs. Everything logs locally, no enterprise stack needed.
Hey Product Hunt! 👋 I'm Hema, the maker of Krain.
i've made this project nearly 1 year ago, but decided to finish it and clean and do some refactoring for the past two months
I run my own VPS, and after a few weeks it just starts getting poked. Constantly. Script kiddies, scanners, bots, crawlers, all hitting the box while the actual site sits quiet on 80/443. Enterprise honeypot platforms exist for this, but they assume you've got a SOC team watching dashboards all day. I don't, and I'm guessing most solo devs and small teams don't either.
So I built krain: a lightweight honeypot you host once, right next to your real site, that gives attackers something far more interesting to poke at than your actual app.
Here's what it does:
Fakes an SSH login, a Grafana dashboard, and a full fake security console
Plants fake secrets (AWS keys, etc.) that lead nowhere real
Tarpits scanners with slow responses, endless directory listings, and gzip bombs
Logs everything locally, no enterprise pipeline needed
Runs isolated in one small container, safe right next to production
It's not hack-back, it's not a shield, and it's not for crawling the internet. It's just bait that sits beside your site and keeps attackers busy instead of you.
The project is open source
Code's here if you want to poke around: github.com/h3ma209/krain-sec
And the documentation and site's here: krain-sec.vercel.app
I'd love your feedback, especially on deploy friction and what would make the decoys more convincing without making the whole thing heavier. I'll be around all day answering questions.
Thanks for checking out krain! 🙏
Love that this exists for small projects, the tarpit idea is genuinely clever. One thing I'd add: a simple Slack or Discord webhook for when a scanner trips a planted credential or hits the tarpit, so you actually notice the hits instead of digging through local logs later. Would make it way more useful day to day.
@maxchennn thank you for the idea i will add that to the list
the logging still needs work thats the most boring part
any other suggestions? also please if you tried it out do give me feedback
The tarpit idea is genuinely clever, turning scanners' own patience against them with slow responses and gzip bombs feels like a satisfyingly cheeky defense. Love that you made it accessible for solo devs instead of gating it behind enterprise complexity.
@tate_dong thank you very much, yes its genuinely satisfying when i tested it and it worked
and my whole goal was that to make it very easy to deploy for small teams and developers