Mantis can generate 22 server-backed artifacts, in two classes. Most are document formats that embed the key URL so the trigger fires when a viewer renders the file; NFC and Wallet artifacts fire through the platform action they are designed for. The credential and config stores are different — they sit where an intruder who already has a shell goes looking, and fire when the URL inside them is used, not when the file is opened.

​
Credential and config stores

The remaining eight formats are a different class of bait. Instead of beaconing when a viewer renders them, they carry the trigger URL in the slot a real file of that kind would — and fire when someone (or a tool they point at it) uses that URL. These are the files an intruder who already has a shell goes looking for, and the ones infostealer and forensic tooling greps by name, so a bait URL in one is found by exactly the person you want to catch. Every embedded secret is a documented example value (AWS’s own AKIAIOSFODNN7EXAMPLE, Stripe’s published test key) or generated nonsense, so nothing here is a live credential anywhere. Because the filename is the disguise, most of these keep the name the real thing has rather than taking the memo — a cookie jar named payroll-laptop.txt is not a cookie jar. See self-hosted apps for per-app recipes (Immich, Paperless, Joplin, Vaultwarden, dashboards, code hosts, etc.).
Office reader caveats:
  • ✅ Microsoft Office desktop apps — fetch external image on render (subject to Protected View for files marked “from internet”; first “Enable Editing” click triggers).
  • ✅ LibreOffice (Writer/Calc/Impress) — fetches external content by default.
  • ⚠ Office on the web / Office 365 in browser — depends on tenant policy.
  • ❌ macOS Quick Look — does not render external content.
PDF reader caveats:
  • ✅ Adobe Acrobat Reader — follows /OpenAction → /URI (may show a one-time trust prompt for the host).
  • ✅ Foxit Reader, PDF-XChange — typically follows OpenAction.
  • ⚠ Chrome, Edge, Firefox built-in viewers — OpenAction not honored; mantis fires only if user clicks the visible “View the latest version online” link.
  • ❌ macOS Preview — OpenAction not honored; click-the-link fallback works.
When you supply no body text, the document formats (.docx, .xlsx, .pptx, .pdf, .html, .md, .eml, .rtf) fall back to a built-in multi-paragraph internal-memo body that opens CONFIDENTIAL — INTERNAL DISTRIBUTION ONLY. It deliberately reads as a genuine document — an earlier default that described itself as placeholder text gave the canary away to the first person who opened it — so editing the file to look authentic afterwards is optional polish, not a required step. The credential/config stores carry their own fixed content and use neither the body nor the memo — except bookmarks, where the memo becomes the visible name of the bait bookmark, so give that key a memo that reads like a real bookmark rather than one that names it as a canary. The .svg / .ics / .vcf / NFC / Wallet formats have no multi-paragraph document body to fall back on either — instead they surface the key memo/title in their title, summary, name, or pass field, and .ics / .vcf route any body you do supply into the event DESCRIPTION / contact NOTE (falling back to that same title when you give none). The key memo and title flow into these artifacts (document properties, calendar/contact fields), so Mantis sanitizes them on generation: control bytes illegal in XML 1.0 are stripped from the Office / SVG / HTML formats, and a lone carriage return is normalized in the line-oriented .ics / .vcf formats — both so a memo carrying stray control characters can’t produce a file that silently fails to open or that injects a forged property line. Apple Wallet artifacts require an Apple Developer Pass Type ID certificate. Set the APPLE_PASS_* env vars on the server (see Configuration); admins can check the current state at /settings/wallet. If Wallet is not configured, format=apple-wallet returns 503 not_configured.