Use exfiltration guard and canaries in your app

You will add canary to your app and check that it works. It takes about 15 minutes.

You need

• A MainSDK app with a main.yaml (see Thirty-minute path).

1. Turn the guard on and set a canary key

Add the sections to main.yaml. Naming either one switches the guard on; an app that names neither is untouched.

exfiltration:
  mode: observe          # log what would be blocked first, then move to enforce
canaries:
  records: { users: 2 }
  keys: true

Put MAINSDK_CANARY_KEY in your secrets store. It is the key the canary registry is hashed with.

2. Plant the canaries

import { canary } from "mainsdk/canary";

await canary.plantAll();                // records for every model under canaries.records, and the keys
const { records, keys } = await canary.status();   // counts only, never ids

Planting twice adds nothing. Run it once per environment.

3. Watch, then enforce

In observe the log shows MAIN-EXFIL-0001 and MAIN-EXFIL-0002 decisions as would-block. When a week passes with none you did not expect, change mode to enforce. A push can tighten the mode without a restart but never loosen it.

Check it worked

Run npx mainsdk check --env staging. It passes when the models exist and canaries are planted, and npx mainsdk canary status --env staging shows your counts.