Register a decoy fingerprint and arm its tripwire. When a monitored deny.sh decrypt endpoint observes a matching fingerprint, it records a critical audit event for your configured Datadog, PagerDuty, or Slack webhooks. Offline decrypts and fake credentials tested against a provider are not automatically observed. Alert delivery and any connected rotation depend on your integrations; no before-read or delivery-time guarantee applies.