Trappsec embeds deception directly in your application code — catching adversaries while they're still mapping your APIs, before a single perimeter is crossed.
Probing your API structure, testing parameters, tracing workflows — all through valid requests that look identical to real user traffic.
Most security programs optimize for what's easy to monitor — known patterns at the perimeter. They have no model of your business logic, so reconnaissance traffic passes through clean.
Disconnected from real application paths, they only trigger post-breach — when the attacker already knows your system. That's a post-compromise signal, not pre-exploitation detection.
Trappsec embeds decoy routes and honey fields directly in your application code. The API surface looks completely uniform to an attacker. Only you can see what's real — and what's a trap.
Unauthenticated probes — bots, scanners, fuzzers — get a 401 and are logged as signals. Only an attacker who returns with credentials triggers an alert. This single requirement eliminates all scanner noise and ensures every alert carries a real identity.
No credentials. Indistinguishable from a thousand other probes you receive daily.
A convincing response — identical to what your real protected endpoints return. The scanner sees nothing unusual.
Logged as a low-priority signal. No alert fires. No noise in your queue.
No credentials — gets the same 401. But unlike the scanner, they care about this endpoint.
The 401 signals "this exists and needs auth." A targeted attacker treats that as confirmation — and authenticates.
User ID, role, IP, and the intent you declared on the trap — captured at the moment of contact.
uid_8849 · role: standard · intent: privilege_escalation
Ghost endpoints that mirror your real API structure. An attacker doing path discovery can't distinguish them from live routes. When accessed, they intercept the request, return a convincing dummy response, and fire an alert.
Non-functional parameters baked into your real API responses. A regular user never touches "is_admin": false. An attacker probing privilege escalation will try to flip it. That's the trigger.
Every event arrives pre-classified with intent and identity. No triage overhead, no log pivoting — everything you need to act is in the payload.
"intent"
"user" "role"
"type": "alert"
Trappsec operates as a lightweight SDK inside your applications. Events route to standard handlers by default, or pipe directly into your existing observability stack.
Supported Frameworks
Flask, FastAPI, Django, Starlette, Sanic, Litestar
Express, Fastify, Hapi, Koa, NestJS
Gin, net/http, Echo
Routes Events To
JSON events to your existing log pipeline
Real-time alerts to your incident channel
Push into Datadog, Honeycomb, Grafana, etc.
Trappsec shifts detection earlier in the attack lifecycle, bringing the signal quality of honeypots directly to the application's real attack surface.
| Traditional Network Deception | Business Logic Deception (Trappsec) | |
|---|---|---|
| Placement | Adjacent to infrastructure | Embedded inside application code |
| Detection Phase | Post-Breach (Assumed Compromise) | Pre-Exploitation (Reconnaissance) |
| Target Activity | Network scanning, lateral movement | API probing, parameter tampering |
| Alert Context | Infrastructure-level (IPs, ports) | Identity-attributed intent |
| Alert Volume | High — many false positives from scanners | Low — only authenticated, targeted actors |
| Integration | Separate appliance or agent | Lightweight SDK |
Built for the 1% of people who actually look at their security alerts — and the 99% who just like the idea of having them.