You don't. You put it in a thought to be private place but you'll find out if it...

Kiro · on March 20, 2018

But why host it somewhere reachable at all?

dewey · on March 20, 2018

It's a canary, it should ideally never be triggered but in case it does you want to know about.

Another way would be to put a fake user in your users database and then watch password leaks and see if it shows up. Then you know you've been breached. It should never happen but if it does it's good to know.