Changelog Interviews – Episode #683
Canary tokens and digital tripwires
Haroon Meer, Security Geek at Thinkst
Haroon Meer is back! Haroon is the Founder of Thinkst, the ~50-person bootstrapped company behind Canary and Canarytokens — honeypots and tripwires you sprinkle inside your network and forget about until an attacker touches one. We talk about the AWS API key token attackers just can’t resist trying, the real credit card token backed by an actual bank partnership, Breadcrumbs (their brand-new feature that leads intruders straight to your canaries), a live demo where a hardware Canary becomes a Synology NAS in one click, and how a company with zero outbound sales and no price increase in ten years quietly passed $22.5 million in ARR.
Featuring
Sponsors
Buildkite – You deserve better CI. Buildkite is engineered for frontier scale and trusted by the teams setting the pace.
WorkOS – Auth for CLI with AuthKit from WorkOS — Bring secure browser-based login to your terminal apps using the OAuth Device Flow, with the same polished AuthKit experience plus SSO, MFA, and passkeys. Learn more at WorkOS.com and AuthKit.com
Notes & Links
- Thinkst
- Thinkst Canary
- Thinkst Canary Security
- Canary Tokens
- Canary Tokens Docs
- Canary Tokens on GitHub
- OpenCanary on GitHub
- OpenCanary Docs
- TechCrunch: A decade in, bootstrapped Thinkst Canary reaches $20M in ARR without VC funding
- Grafana Labs: Canary Tokens, the unsung heroes of security
- Canary Love
Chapters
| Chapter Number | Chapter Start Time | Chapter Title | Chapter Duration |
| 1 | 00:00 | Welcome back Haroon! | 02:10 |
| 2 | 02:10 | Fifty people, zero outbound sales, 22.5M ARR | 01:57 |
| 3 | 04:07 | Honeypots inside the network, not research toys | 03:00 |
| 4 | 07:07 | The AWS API key attackers can't resist | 02:13 |
| 5 | 09:20 | Hosting Canarytokens free for the world | 02:14 |
| 6 | 11:33 | Ten years without a price increase | 04:39 |
| 7 | 16:12 | A Python shop and a self-hosted token server | 04:24 |
| 8 | 20:37 | Real credit card as a tripwire | 02:16 |
| 9 | 22:53 | Dragging attacks into molasses | 04:02 |
| 10 | 26:55 | Demo: Synology NAS in one click (watch on YouTube) | 09:41 |
| 11 | 36:36 | WireGuard tokens, QR codes, and dumpster divers | 04:11 |
| 12 | 40:47 | Sponsor: Buildkite | 02:49 |
| 13 | 43:35 | Securing the canaries themselves | 02:11 |
| 14 | 45:46 | $7.5K to start, million-dollar customers | 03:14 |
| 15 | 49:00 | Airport ads, padel, and quality swag | 05:50 |
| 16 | 54:50 | Open Canary, the free little brother | 01:38 |
| 17 | 56:28 | Self-hosting and sovereignty in the agent era | 05:39 |
| 18 | 1:02:07 | Divergent codebases and DNS-tunneled updates | 06:16 |
| 19 | 1:08:23 | A first acquisition and open source PRs | 05:00 |
| 20 | 1:13:22 | Breadcrumbs lead attackers to canaries | 05:52 |
| 21 | 1:19:14 | Tokens in binaries, catching reverse engineers!! | 03:08 |
| 22 | 1:22:22 | Sponsor: WorkOS | 02:16 |
| 23 | 1:24:38 | Why Python still pays the bills | 09:01 |
| 24 | 1:33:39 | Don't overthink it. Just deploy. | 07:54 |
| 25 | 1:41:33 | GPL, clean rooms, and playing with other vendors | 03:02 |
| 26 | 1:44:35 | Growth without jet fuel | 06:30 |
| 27 | 1:51:05 | canary.love, law enforcement, NVIDIA, and Grafana | 11:41 |
| 28 | 2:02:46 | Wrapping up...canary.tools and canarytokens.org | 04:00 |