Skip to main content

​
Trust & Security

Deadfall is designed with privacy and security as core principles.

​
Security Guarantees

​
Local Processing

  • Runs entirely locally — No cloud dependencies
  • No telemetry — Usage data never leaves your machine
  • No account required — No signup, no tracking
  • Works offline — No internet required for core features

​
Open Source

Deadfall is fully open source under the MIT license: 
# Clone and audit
git clone https://github.com/dotsetlabs/deadfall
cd deadfall
All code is auditable. No obfuscation, no analytics, no phone-home.

​
What Deadfall Stores

​
Configuration File (deadfall.json)

{
  "traps": [
    {
      "path": ".cursorrules",
      "token": "abc123...",
      "type": "cursor-rules",
      "created_at": "2026-01-05T14:32:00Z"
    }
  ]
}
This file tracks:
  • File paths with traps
  • Unique tokens for correlation
  • Trap types and creation times

​
Alert Log (deadfall_alerts.log)

Plain-text log file with timestamps and alert details: 
2026-01-05T14:32:15-05:00 [critical] [Trap Triggered]: AI agent read trapped file | file=.cursorrules

​
Threat Model

​
What Deadfall Protects Against

ThreatHow
AI agent compromiseCognitive honeypots detect instruction following
Credential-seeking agentsHoneypot tools attract and alert on access attempts
Unknown threatsAI-specific traps are read automatically by assistants

​
What Deadfall Does NOT Protect Against

ThreatWhyMitigation
Real-time blockingDeadfall detects, doesn’t preventUse Tollgate
Non-AI threatsRelies on instruction-following behaviorUse traditional honeypots
Disabled MCP serverTraps require the server runningKeep server running

​
Trust Boundaries

​
Trusted

  1. Deadfall binary — Built from open source
  2. Local filesystem — OS-level security
  3. MCP client — Configured by user

​
Untrusted

  1. AI agents — May be compromised
  2. Network — Webhook delivery should use HTTPS

​
Best Practices

​
File Permissions

# Restrict config file
chmod 600 deadfall.json

# Restrict log file  
chmod 600 deadfall_alerts.log

​
Git Ignore

Always add to .gitignore: 
deadfall.json
deadfall_alerts.log

​
Webhook Security

If using webhook alerts, always use HTTPS URLs and keep webhook URLs secret.

​
Reporting Security Issues

Report security vulnerabilities to: Please do not open public issues for security vulnerabilities.