Skip to content

Commit 8fd45c7

Browse files
Disane87claude
andcommitted
docs: README in spoolman style, add LICENSE, drop em-dashes
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 parent f92ecf1 commit 8fd45c7

4 files changed

Lines changed: 48 additions & 37 deletions

File tree

DESIGN_PRD.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
# Design PRD hon.ey
1+
# Design PRD: hon.ey
22

33
> **Zweck dieses Dokuments:** Eine implementierungsreife Design-Spezifikation für das
44
> hon.ey-Dashboard. Es ist so geschrieben, dass ein Agent (z. B. Claude) das Design ohne
@@ -21,7 +21,7 @@ unverdächtig aussehende Tracking-Links und sehen, *wer* sie öffnet und *mit we
2121
### Zielgruppe & Tonalität
2222
Sicherheitsbewusste, technische Nutzer:innen (Pentester, IT-Security, Admins). Das Tool wird
2323
oft in stressigen Situationen genutzt. Die UI SOLL deshalb **freundlich, ruhig und
24-
vertrauenswürdig** wirken bewusst das Gegenteil eines kühlen „Hacker-Terminals".
24+
vertrauenswürdig** wirken, bewusst das Gegenteil eines kühlen „Hacker-Terminals".
2525

2626
---
2727

@@ -100,7 +100,7 @@ Laden via Google Fonts im `<head>` (siehe `nuxt.config.ts`). Fallbacks Pflicht.
100100
| Section-Title | mono | 12px / 700 / 0.14em / UPPERCASE / `--ink-faint` |
101101
| Label (Form) | sans | 13px / 600 / `--ink-soft` |
102102
| Tabelle TH | mono | 11px / 700 / 0.1em / UPPERCASE / `--ink-faint` |
103-
| Code / URL / IP| mono | 12.513px |
103+
| Code / URL / IP| mono | 12.5-13px |
104104

105105
H1 SOLL ein eingefärbtes Akzent-Wort enthalten (`<span class="accent">` in `--honey-deep`).
106106
Mobile (≤760px): H1 auf 30px.
@@ -122,7 +122,7 @@ Mobile (≤760px): H1 auf 30px.
122122
- **Container:** `max-width: 1080px`, `padding: 0 24px`, zentriert.
123123
- **Seiten-Padding vertikal:** `38px` oben, `80px` unten.
124124
- **Motion-Timing:** Standard `0.15s ease` (Hover), Einblendungen
125-
`0.450.5s cubic-bezier(.2,.7,.2,1)`. `prefers-reduced-motion` respektieren (Animationen aus).
125+
`0.45-0.5s cubic-bezier(.2,.7,.2,1)`. `prefers-reduced-motion` respektieren (Animationen aus).
126126

127127
### 4.4 Hintergrund (App-Body)
128128

@@ -198,7 +198,7 @@ Jede Komponente mit Default + relevanten States (hover/focus/disabled/active/emp
198198
- **Ghost (`.btn.ghost`):** weiße Fläche, `--ink-soft`, 1.5px `--border-strong`. Hover: `--honey-soft`.
199199
- **Danger (`.btn.danger`):** transparent, `--coral`, Rahmen `--coral-soft`. Hover: `--coral-soft`-Fläche.
200200
- **Small (`.btn.sm`):** 7px 13px / 13px.
201-
- Buttons mit Icon: Icon links, `gap: 78px`.
201+
- Buttons mit Icon: Icon links, `gap: 7-8px`.
202202

203203
### 7.2 Eingaben (`input, select, textarea`)
204204
- Fläche `--surface-2`, Rahmen 1.5px `--border`, Radius `--r-sm`, Padding 11px 13px, 15px.
@@ -346,7 +346,7 @@ Jede Komponente mit Default + relevanten States (hover/focus/disabled/active/emp
346346
## 12. Content / Copy
347347

348348
- **Stimme:** freundlich, klar, kurz. Beispiele: „Your honey traps",
349-
„Friendly-looking links that quietly note down everyone who opens them and exactly how.",
349+
„Friendly-looking links that quietly note down everyone who opens them and exactly how.",
350350
„All quiet", „Waiting for the first visitor".
351351
- UI-Sprache: Englisch. Fachbegriffe konsistent: *trap, hit, verdict (human/bot), preview*.
352352
- Keine Ausrufezeichen-Inflation, keine Emojis, kein Marketing-Sprech.
@@ -370,7 +370,7 @@ Jede Komponente mit Default + relevanten States (hover/focus/disabled/active/emp
370370

371371
## 14. Out of Scope (aktuell) / mögliche Erweiterungen
372372

373-
- Authentifizierung fürs Dashboard (derzeit keine) empfohlen vor Deployment.
373+
- Authentifizierung fürs Dashboard (derzeit keine), empfohlen vor Deployment.
374374
- Bearbeiten bestehender Traps (nur anlegen/löschen vorhanden).
375375
- Dark-Mode-Variante (das Theme ist bewusst hell; ein Dark-Pendant wäre additiv).
376376
- Karten-/Geo-Visualisierung der Treffer, CSV/JSON-Export, Charts.

README.md

Lines changed: 30 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -6,23 +6,23 @@
66
![GitHub issues](https://img.shields.io/github/issues/Disane87/honey?color=red)
77

88

9-
# 🍯 hon.ey URL Honeypot
9+
# 🍯 hon.ey URL Honeypot
1010

1111
Hey there! 👋 **hon.ey** turns any link into a tripwire. Create innocent-looking URLs, plant them
1212
wherever you want to keep an eye on things, and the moment someone opens one you'll know exactly
13-
*who* showed up and *with what*. 🕵️‍♀️✨
13+
*who* showed up and *with what*. 🕵️‍♀️✨
1414

1515
Think of it as a [canary token](https://canarytokens.org/) you fully control: leaked-credential
16-
docs, fake internal links, "confidential" attachments, tracking pixels in emails — drop a hon.ey
16+
docs, fake internal links, "confidential" attachments, tracking pixels in emails. Drop a hon.ey
1717
link and watch the metadata roll in.
1818

1919
> [!WARNING]
20-
> ## 🔒 This is a defensive tool keep it on a leash
20+
> ## 🔒 This is a defensive tool, so keep it on a leash
2121
> hon.ey is for **authorized** security testing and monitoring of assets *you own or are allowed to
2222
> watch*. The dashboard has **no authentication** and the `custom` trap renders **raw HTML**, so
23-
> never expose it to the open internet — run it behind a VPN, basic auth, or an IP allowlist. Using
24-
> tracking/cloaked links against third parties without consent may break privacy law (GDPR & friends)
25-
> and impersonating a brand you don't control is plain phishing. Be a good human. 🙏
23+
> never expose it to the open internet. Run it behind a VPN, basic auth, or an IP allowlist. Using
24+
> tracking or cloaked links against third parties without consent may break privacy law (GDPR &
25+
> friends), and impersonating a brand you don't control is plain phishing. Be a good human. 🙏
2626
2727

2828
# ✨ What Can This Thing Do?
@@ -48,31 +48,31 @@ Each trap is just a URL you plant somewhere. What happens when it's opened depen
4848

4949
| Type | What the visitor sees | Great for |
5050
|------|------------------------|-----------|
51-
| 👁️ **pixel** | An invisible 1×1 image | Emails & documents embed `<img src="…/p/<slug>.png">` |
51+
| 👁️ **pixel** | An invisible 1×1 image | Emails & documents: embed `<img src="…/p/<slug>.png">` |
5252
| ↪️ **redirect** | Gets forwarded to a real URL | Looks like a totally normal short link |
5353
| 🪞 **clone** | The cloned preview of a target, then forwarded to it | Making a link unfurl exactly like the real thing |
54-
| 🎨 **custom** | Your hand-crafted preview + a redirect *or* your own HTML | Suggesting a believable fake page |
54+
| 🎨 **custom** | Your hand-crafted preview plus a redirect *or* your own HTML | Suggesting a believable fake page |
5555
| 🎭 **decoy** | A friendly "loading…" page | A soft landing that reveals nothing |
5656

5757
> [!NOTE]
58-
> 🔔 Whatever the type, every single open is logged with the full metadata the visitor just never
59-
> notices a thing.
58+
> 🔔 Whatever the type, every single open is logged with the full metadata, and the visitor just
59+
> never notices a thing.
6060
6161

6262
# 🔍 What Gets Captured
6363

6464
Every hit records the juicy details:
6565

66-
- 🌐 **Full IP chain** `X-Forwarded-For`, `CF-Connecting-IP`, `X-Real-IP`, and the socket address
67-
- 📍 **Geo & network** country, city, region, ISP, org, ASN (via [ip-api.com](https://ip-api.com), can be turned off)
68-
- 🧭 **Client fingerprint** browser, version, OS, device, engine (parsed from the User-Agent)
69-
- 🗣️ **Headers & hints** referer, `Accept-Language`, and the complete raw request headers
70-
- 🤖 **Bot verdict** human or bot, plus the heuristic reason it decided that
66+
- 🌐 **Full IP chain**: `X-Forwarded-For`, `CF-Connecting-IP`, `X-Real-IP`, and the socket address
67+
- 📍 **Geo & network**: country, city, region, ISP, org, ASN (via [ip-api.com](https://ip-api.com), can be turned off)
68+
- 🧭 **Client fingerprint**: browser, version, OS, device, engine (parsed from the User-Agent)
69+
- 🗣️ **Headers & hints**: referer, `Accept-Language`, and the complete raw request headers
70+
- 🤖 **Bot verdict**: human or bot, plus the heuristic reason it decided that
7171

7272

7373
# 📦 Installation
7474

75-
Two easy ways to get going grab the container, or run it from source. 🎉
75+
Two easy ways to get going: grab the container, or run it from source. 🎉
7676

7777

7878
# 🐳 Docker (the easy way)
@@ -91,7 +91,7 @@ docker run -d --name honey \
9191
Then open **http://localhost:3000** and start setting traps! 🍯
9292

9393
- 🔌 Listens on `:3000` (change with `-e PORT=`), binds `0.0.0.0`, runs as a non-root user
94-
- 💾 Trap & hit data lives in `/app/.data` mount a volume to keep it across restarts
94+
- 💾 Trap & hit data lives in `/app/.data`, so mount a volume to keep it across restarts
9595
- ❤️ Built-in healthcheck hits `/api/traps` so your orchestrator knows when it's ready
9696
- 🏷️ Tags available: `latest`, `sha-<short>`, and semver (`1.2.3`, `1.2`) on `v*` releases
9797

@@ -123,7 +123,7 @@ node .output/server/index.mjs
123123

124124
> [!IMPORTANT]
125125
> Put hon.ey behind a reverse proxy (nginx / Caddy / Traefik) so `X-Forwarded-For` carries the
126-
> *real* client IP — otherwise every hit looks like it came from your proxy. 🤷
126+
> *real* client IP. Otherwise every hit looks like it came from your proxy. 🤷
127127
128128

129129
# ⚙️ Configuration
@@ -132,8 +132,8 @@ A couple of environment variables, that's all:
132132

133133
| Variable | Default | What it does |
134134
|----------|---------|--------------|
135-
| `NUXT_PUBLIC_BASE_URL` | *(empty)* | The public base URL for your tracking links. Set it to your domain (e.g. `https://honey.example.com`) so copied URLs point at the right place. Empty → falls back to the browser's current origin. |
136-
| `NUXT_GEO_LOOKUP` | `true` | Outbound IP geo enrichment via ip-api.com. Set `false` to stay 100% local with zero outbound calls. |
135+
| `NUXT_PUBLIC_BASE_URL` | *(empty)* | The public base URL for your tracking links. Set it to your domain (e.g. `https://honey.example.com`) so copied URLs point at the right place. If empty, it falls back to the browser's current origin. |
136+
| `NUXT_GEO_LOOKUP` | `true` | Outbound IP to geo enrichment via ip-api.com. Set `false` to stay 100% local with zero outbound calls. |
137137
| `PORT` | `3000` | Port the server listens on. |
138138
| `HOST` | `0.0.0.0` | Bind address. |
139139

@@ -144,23 +144,23 @@ There's a ready-to-copy [`.env.example`](.env.example) too. 📝
144144

145145
hon.ey ships with three friendly screens:
146146

147-
- 🪤 **Traps** your command center. Create traps, copy their URLs, see hit counts at a glance.
148-
- 📡 **Live Feed** every recent visitor across all traps, auto-refreshing so you don't have to.
149-
- 🔎 **Trap Detail** the full hit timeline with expandable metadata, plus the link-preview card for clone/custom traps.
147+
- 🪤 **Traps**: your command center. Create traps, copy their URLs, see hit counts at a glance.
148+
- 📡 **Live Feed**: every recent visitor across all traps, auto-refreshing so you don't have to.
149+
- 🔎 **Trap Detail**: the full hit timeline with expandable metadata, plus the link-preview card for clone/custom traps.
150150

151151
Want to design a fake preview? The **Custom Preview Builder** lets you type a title, description and
152-
image URL and watch the social-card preview update live then pick whether humans get redirected or
152+
image URL and watch the social-card preview update live, then pick whether humans get redirected or
153153
shown your own HTML. 🪄
154154

155155

156156
# 🛠️ Tech Stack
157157

158158
Built with the good stuff:
159159

160-
-**[Nuxt 4](https://nuxt.com) + [Vue 3](https://vuejs.org)** SSR app & Nitro server in one
160+
-**[Nuxt 4](https://nuxt.com) + [Vue 3](https://vuejs.org)**: SSR app & Nitro server in one
161161
- 🎀 **[@nuxt/icon](https://github.com/nuxt/icon)** with the [Lucide](https://lucide.dev) set (bundled locally, no CDN)
162-
- 🧩 **[unstorage](https://unstorage.unjs.io)** file-based persistence, nothing else to install
163-
- 🐳 **Multi-stage Docker** + GitHub Actions GHCR
162+
- 🧩 **[unstorage](https://unstorage.unjs.io)**: file-based persistence, nothing else to install
163+
- 🐳 **Multi-stage Docker** plus GitHub Actions to GHCR
164164

165165

166166
# ⚠️ Legal & Ethical Note
@@ -169,9 +169,9 @@ hon.ey is a **defensive** instrument. Only deploy it on assets and networks you
169169
explicitly authorized to monitor. The geo lookup sends visitor IPs to a third-party API (disable it
170170
if that's a concern), the `clone` and `custom` traps can reproduce or fabricate link previews, and
171171
the `custom` trap renders operator-authored HTML verbatim. Don't use any of this to deceive or
172-
impersonate third parties that crosses into phishing and is illegal in most places. 🙏
172+
impersonate third parties, because that crosses into phishing and is illegal in most places. 🙏
173173

174174

175175
# 📄 License
176176

177-
[MIT](LICENSE) — do good things with it.
177+
[MIT](LICENSE). Do good things with it.

package-lock.json

Lines changed: 10 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

package.json

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
"postinstall": "nuxt prepare"
1313
},
1414
"dependencies": {
15+
"@iconify-json/circle-flags": "^1.2.10",
1516
"@iconify-json/lucide": "^1.2.114",
1617
"@nuxt/icon": "^2.2.3",
1718
"nuxt": "^4.4.8",

0 commit comments

Comments
 (0)