Tenant isolation
Every operational record belongs to an organization and every request is authorized against the active membership.
Security model
Built to protect the protected site.
Security controls are layered across tenant access, agent identity, evidence handling, AI processing, and local policy enforcement.
Signed agent traffic
Unique per-site keys, timestamps, nonces, body hashes, and idempotency protect the plugin contract.
Secure sessions
HttpOnly cookies, server-side sessions, origin-based CSRF protection, Argon2id passwords, and a fixed login-attempt rate limit protect account access.
Evidence minimization
Suspicious-only capture, strict caps, credential removal, output encoding, and 30-day raw-event retention.
Bounded enforcement
Seven-day observation, protected ranges, explicit TTLs, signed policy delivery, acknowledgements, and fail-open expiry bound local enforcement.
Safe decoys
Only inert HTTP routes—no real shells, SSH, databases, executable payloads, or stored fake-login passwords.
Responsible scope
Two safe client deployment choices.
Normal hosting uses inert WordPress decoy routes and application-level blocking. Docker clients may add an isolated OpenCanary module for network detection; it is allowlisted, does not join application networks, and never enforces firewall policy.
Make every WordPress site a smarter sensor.
Join the controlled pilot and see coordinated threat intelligence across your portfolio.