TokenTether

TokenTether is a web app (with optional CLI) that continuously hunts for exposed cloud credentials and short-lived tokens across the places teams actually leak them: CI logs, build artifacts, container images, internal wikis, paste tools, and developer chat exports. When it finds a token, it validates whether it’s still live, identifies the owning cloud identity, and triggers automated containment: revoke/rotate, quarantine the pipeline job, and open a ticket with exact remediation steps. It also maps “token blast radius” by simulating what the token can access (read-only enumeration, no destructive actions) and produces a prioritized risk queue. This is a combination app: traditional detection + AI-assisted triage that summarizes the leak source, likely root cause, and the smallest fix (masking, log redaction, secret scoping, CI config changes). It’s not a full CSPM; it’s narrowly focused on credential exposure response.