🛡️ NI-Stack Red Team Console — SSOT

🍯 What is the Honeypot (V3)? The /api/v1/scan endpoint is a decoy — it returns a fake 403 with HONEYPOT_ACTIVE. If an attacker hits this before V1/V2, we know they're probing endpoints. It logs their IP, payload, and reconnaissance pattern. Smart attackers skip it; naïve scanners get fingerprinted.