HoneyWire is a decentralized deception sensor deployment system that transforms any Linux box into a high-fidelity network canary. The architecture consists of a trusted Hub (central orchestrator and policy enforcer), an untrusted local Wizard (CLI tool generating deployment intents), untrusted external manifests describing sensor behavior, and sandboxed Docker containers running sensors. The Hub is the sole trust anchor responsible for validating manifests, enforcing security policies, and producing deployment artifacts. Threats include supply chain compromise via malicious manifests or container images, manipulation of deployment intents by a compromised Wizard, privilege escalation through unsafe container configurations, and compromise of the Hub itself. Mitigations implemented include strict JSON schema validation, image digest pinning, capability allowlisting, read-only root filesystems, and rate limiting of API keys. Some mitigations remain unimplemented, such as cryptographic manifest signature verification and signed deployment artifact enforcement. Accepted risks include the possibility of local tampering with deployment files and exposure of bootstrap credentials during initial provisioning. The security model is based on zero trust principles, treating all inputs as hostile and enforcing compile-time security policies to ensure least privilege and deterministic deployment.

If exploited, attackers could deploy malicious sensor manifests or container images, potentially leading to unsafe privilege requests or execution of compromised binaries within sensor containers. A compromised local Wizard could leak environment metadata or inject unsafe configurations, possibly causing privilege escalation or local denial of service. Unsafe container configurations could enable host compromise via container escape or unauthorized access. A Hub compromise could allow malicious generation of deployment artifacts, bypassing validation rules. Node authentication compromise could result in audit log confusion, false alerts, or denial of service on the Hub. However, some risks require local host compromise with root-level access, which is considered outside HoneyWire's security boundary. The platform's mitigations reduce but do not eliminate these risks due to some unimplemented controls.

HoneyWire includes multiple implemented mitigations such as strict schema validation, image digest pinning, capability allowlisting, read-only root filesystems, and API rate limiting. Users should ensure the Hub runs in a secure, controlled environment and maintain OS-level protections. Since some mitigations like cryptographic manifest signature verification and signed deployment artifact enforcement are not yet implemented, users should monitor the HoneyWire project for updates addressing these gaps. The platform assumes that local host compromise is outside its threat model; therefore, protecting host integrity and Docker socket access is critical. No urgent action is required beyond following best practices for securing the Hub and host environments and applying future HoneyWire updates when available.