TokenTriage

TokenTriage is a web app (with a lightweight GitHub/GitLab integration) that continuously detects exposed API keys, OAuth tokens, and credentials across code repos, CI logs, container images, and pasted snippets in internal tools. It doesn’t just alert—it guides remediation with exact file/line context, blast-radius estimation (what the token can access), and step-by-step rotation playbooks per provider. For common services (AWS, GCP, GitHub, Slack, Stripe, Twilio), it can optionally automate revocation/rotation via scoped service accounts and create a verified “fixed” state. The product focuses on small-to-mid engineering orgs that are tired of noisy secret scanners and slow incident response. Expect real constraints: integrations are the hard part, and false positives will kill adoption unless you invest heavily in tuning, allowlists, and developer-friendly workflows.