A canary is a deliberately fake asset — a URL, API key, or file name — that should never be touched unless someone is already inside your perimeter or reading your mail.