Honeytokens that recognise themselves: stateless decoys with automatic attribution

Every signal in the previous articles is statistical. They weigh evidence, they have thresholds, they can be argued with. Honeytokens are different in kind. A honeytoken is a record that does not exist and was never given to anyone . Nothing legitimate can ask for it, because nothing legitimate has ever held a reference to it. A request for one isn't suspicious — it's proof that someone is guessing or working from a stolen list. That makes it the highest-confidence signal available, and worth building carefully. Derivation: make the decoy recognise itself The obvious implementation is a table. Generate decoy IDs, store them, and check every miss against the table. That has two problems. It puts a database lookup in the request path on every miss — and misses are exactly what a flood produces. And it doesn't tell you whose decoy was tripped without another join. Instead, derive them: export function honeytokenFor ( clientId : string , n : number , generation = 0 ): string { const mac = createHmac ( ' sha256 ' , config . honeytokenSecret ) . update ( ` ${ clientId } : ${ generation } : ${ n } ` ) . digest (); return uuidFromBytes ( mac . subarray ( 0 , 16 )); } Three properties fall out of this, and they're the whole design: Recognition is stateless. Given any ID and any client, recompute the client's decoy set and check membership. No lookup, no cache, no round trip. The gateway precomputes each known client's set at startup into a Set and membership is O(1). Attribution is automatic. The client ID is inside the derivation. There is no "which client did this decoy belong to?" question — a decoy for integration-acme is not a decoy for anyone else, and cannot be. If a decoy seeded into acme's scope is requested by a different credential, that's information too. They're format-identical to real IDs. The output is shaped as a v4 UUID — correct version and variant nibbles — so it is indistinguishable from a real documents identifier: export function uuidFromBytes ( bytes