How an attacker spots a honeytoken without setting it off: metadata, documents, callback domains, AWS keys, and what defeats each one.
