Ideas/Feedback

Next up

In Progress

Live

Main Roadmap

Alert if a token you track is found in public breach data (integration with HaveIBeenPwned, GitGuardian).

In Review

Threat Intel Feed

Franz

Flexera, Snow, or Custom License Portals: track commercial software license keys/expiry.

License Management tools integration

An admin should be able to define other admins from members of a workspace or to pass the lead to another user

Allow multiple admins per workspace

<ul><li>Send expiring asset alerts to Opsgenie as incidents</li></ul><ul><li>Create incidents when certificates/secrets expire or are about to expire</li></ul><ul><li>Auto-resolve incidents when assets are renewed/updated</li></ul><ul><li>Use Opsgenie's on-call routing for critical expirations</li></ul>

Opsgenie webhook integration

Allow user to store documents

<ul><li>Parse Terraform state files to extract resources with expiration dates</li></ul><ul><li>Scan for certificates, secrets, API keys, and licenses managed by Terraform</li></ul><ul><li>Import resources with their expiration metadata</li></ul><ul><li>Track resources across multiple Terraform workspaces/projects</li></ul>

Terraform integration (state file scanning)

Score of criticity per token based on permissions/privileges of the token (if applicable)

Planned

Risk based classification

<ul><li>Alerts expiration</li><li>Weekly digests</li><li>Endpoint checker</li></ul>

Telegram webhook integration

<ul><li>High-level risk overview: count of expiring assets by category, critical items, compliance status</li></ul><ul><li>Cost tracking: total license/subscription costs, renewal dates, budget forecasting</li></ul><ul><li>Team metrics: workspace activity, alert delivery success rates, response times</li></ul><ul><li>Trend analysis: expiration patterns over time, peak renewal periods, historical incidents</li></ul><ul><li>Compliance at a glance: audit log summaries, GDPR/FADP compliance status, certification coverage</li></ul>

Executive Dashboards

Gitlab, Ansible, Jenkins, CircleCI, GitHub Actions, etc…

Create playbooks and CI/CD templates to ease lifecycle management

ITSM/ticketing tools Integration : token lifecycle related task (Jira, ServiceNow, GLPI, Trello/Asana, PagerDuty, etc…) :<ul><li>Auto-escalation: when critical assets expire, automatically create incidents in PagerDuty/Jira/Opsgenie</li></ul><ul><li>Runbook automation: trigger predefined workflows (e.g., rotate keys, renew certificates) when thresholds are hit</li></ul><ul><li>Post-mortem tracking: link expired assets to incident reports, track root causes</li></ul><ul><li>On-call routing: route critical expiration alerts to the right on-call engineer based on asset ownership</li></ul><ul><li>Incident prevention: analyze patterns to predict and prevent incidents before they occur</li></ul><ul><li>Integration hooks: connect to incident management tools to create tickets, update status, and auto-resolve when assets are renewed</li></ul>

Incident response workflows

Gather secrets metadata from other vaults : Doppler, 1Password, Bitwarden, LastPass Enterprise Vaults, CyberArk

Integration with more vaults (secrets manager)

Periodic push system (or scraping?)

Integration with Prometheus, New Relic, Datadog, Elasticsearch (metrics collection systems)

<ul><li>Scan Bitbucket repositories for deploy keys, access tokens, and SSH keys</li></ul><ul><li>Import repository secrets with expiration dates</li></ul><ul><li>Track SSH key expiration across repositories</li></ul>

Bitbucket integration

Actionnable buttons to trigger API based renewal actions (cloud providers or custom)

Auto-renewal

Identity Providers & SSO authentication

Completed

On-premise version of TokenTimer (tokentimer-core + enterprise)

Allow to easily select tokens in the list to perform bulk operations such as change contact group, change section, change owner, etc…

Token dashboard bulk edition

Product tour and demo

New token matching name + location should merge content from old token and new one after user confirmation, both in manual creation and import features.

Add deduplication mechanism

<ul><li>Email notifications</li><li>Webhooks (Slack, Discord, Teams, PagerDuty, Generic)</li><li>WhatsApp notifications</li></ul>

Intelligent Alerting

Import from Source Code Management platforms: Github and Gitlab

Scan public domains on a daily basis to ensure certificate is still valid

Public domains tracking

Auto-sync from Cloud Providers and Source Code Management platforms (tokentimer-core + tokentimer-enterprise)

User requested to know when a token imported was created or last used, to have a better view of forgotten or old tokens

Imported tokens : creation and last usage date

User requested to be able to see the last time an integration was synced so it’s easier to know when the inventory from a provider actually was made for the last time