# derp - Backlog

## Core

- [ ] Multi-server support (per-server config, shared plugins)
- [ ] Stable plugin API (versioned, breaking change policy)
- [ ] Paste overflow (auto-paste long output to FlaskPaste)
- [ ] URL shortener integration (shorten URLs in alerts/output)
- [ ] Webhook listener (HTTP endpoint for push events to channels)
- [ ] Granular ACLs (per-command: trusted, operator, admin)

## Plugins -- Security/OSINT

- [ ] `emailcheck` -- SMTP VRFY/RCPT TO verification
- [ ] `canary` -- canary token generator/tracker
- [ ] `virustotal` -- hash/URL/IP/domain lookup (free API)
- [ ] `abuseipdb` -- IP abuse confidence scoring (free tier)
- [ ] `jwt` -- decode tokens, show claims/expiry, flag weaknesses
- [ ] `mac` -- OUI vendor lookup (local IEEE database)
- [ ] `pastemoni` -- monitor paste sites for keywords

## Plugins -- Utility

- [ ] `paste` -- manual paste to FlaskPaste
- [ ] `shorten` -- manual URL shortening
- [ ] `cron` -- scheduled bot commands on a timer

## Testing

- [ ] Plugin command unit tests (encode, hash, dns, cidr, defang)
- [ ] CI pipeline