---
title: "Use exfiltration guard and canaries in your app"
description: "Stop a stolen secret or a bulk copy of personal data leaving your app, and plant records and keys that raise an alarm when an intruder touches them."
section: "guides"
status: "Building for 0.4"
spec: "exfiltration-guard"
canonical: "https://mainsdk.dev/docs/guides/use-canary"
updated: "2026-10-28"
---

# Use exfiltration guard and canaries in your app

> Stop a stolen secret or a bulk copy of personal data leaving your app, and plant records and keys that raise an alarm when an intruder touches them.

Status: Building for 0.4 · Canonical: https://mainsdk.dev/docs/guides/use-canary · Updated: 2026-10-28

You will add `canary` to your app and check that it works. It takes about 15 minutes.

## You need

- A MainSDK app with a `main.yaml` (see [Thirty-minute path](https://mainsdk.dev/docs/getting-started/thirty-minutes)).

## 1. Turn the guard on and set a canary key

Add the sections to `main.yaml`. Naming either one switches the guard on; an app that names neither is untouched.

```yaml title="main.yaml"
exfiltration:
  mode: observe          # log what would be blocked first, then move to enforce
canaries:
  records: { users: 2 }
  keys: true
```

Put `MAINSDK_CANARY_KEY` in your secrets store. It is the key the canary registry is hashed with.

## 2. Plant the canaries

```ts title="scripts/plant.ts"
import { canary } from "mainsdk/canary";

await canary.plantAll();                // records for every model under canaries.records, and the keys
const { records, keys } = await canary.status();   // counts only, never ids
```

Planting twice adds nothing. Run it once per environment.

## 3. Watch, then enforce

In `observe` the log shows `MAIN-EXFIL-0001` and `MAIN-EXFIL-0002` decisions as would-block. When a week passes with none you did not expect, change `mode` to `enforce`. A push can tighten the mode without a restart but never loosen it.

## Check it worked

Run `npx mainsdk check --env staging`. It passes when the models exist and canaries are planted, and `npx mainsdk canary status --env staging` shows your counts.