Skip to content

Latest commit

 

History

4 Commits

Folders and files

NameName
Last commit message
Last commit date
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Exposure Audit

Find out where you already are online, before you try to leave.

Give it your own email, username, domain or GitHub handle. It checks where those show up publicly, ranks the findings by how much damage each one could do, and tells you how to get removed from each.

Companion to data-deletion-skill. That one removes you. This one tells you what there is to remove.

Python · MIT licensed · by 0nicell


What it checks

Live checks run automatically. They only look at places that publish you, with no account and no scraping:

Check What it finds
Gravatar A public photo and profile tied to your email address
GitHub commit emails Your real address baked permanently into public commits
Handle enumeration The same username across 28 platforms, linking accounts you thought were separate
WHOIS / RDAP Your contact details published for domains you own
Certificate transparency Every subdomain you ever issued a certificate for — staging, admin, client previews
Wayback Machine Contact details you deleted from your site but not from the archive
Have I Been Pwned Which breaches you're in and what was exposed (needs an API key)

A worklist is generated from the 314-company registry in data-deletion-skill: every live site, ranked by how much harm it enables, with a working removal contact attached.

Registry  277 live sites to check (37 defunct/contactless)
  CRITICAL  68     breach search + infostealer/threat-intel corpora
  HIGH      65     people search, major brokers, electoral-roll directories
  MEDIUM    96     B2B contact data, OSINT email intelligence
  LOW       48     ad-tech segments, email verification

You get report.md and findings.json. Hand the markdown to data-deletion-skill and it writes the removal requests.


Setup

git clone https://github.com/0nicell/exposure-audit.git
cd exposure-audit
pip install requests pyyaml

To use it as a Claude skill instead:

git clone https://github.com/0nicell/exposure-audit.git ~/.claude/skills/exposure-audit

Running it

The basic run:

python3 exposure_audit.py --email you@example.com --username yourhandle \
                         --domain yoursite.com --github yourhandle

Save your details in a file instead of retyping them:

cp profile.example.yml profile.yml && $EDITOR profile.yml
python3 exposure_audit.py --profile profile.yml

profile.yml is gitignored. Keep it that way.

Include breach data — needs a Have I Been Pwned key, around $4/month:

python3 exposure_audit.py --email you@example.com --hibp-key "$HIBP_API_KEY"

Just the worklist, no internet checks:

python3 exposure_audit.py --email you@example.com --registry-only

How the severity ranking works

Categories are scored by the damage they enable, not by how creepy they feel:

Level What it means Example
CRITICAL Your passwords Breach-search engines, malware log dumps. Someone takes over your accounts
HIGH The physical world Home address, relatives, electoral roll. A safety problem
MEDIUM Your identity graph Name, employer, and the jump from your email to your accounts
LOW Ad targeting Hashed IDs and guesses about your behaviour. Real, but not a lever against you

The one design decision worth explaining

Every run tests itself first.

Several platforms return "page found" for usernames that don't exist. Simple username-checking tools read that as a real account and hand you a list of profiles you never created.

So before checking your handle, this tool checks a made-up one. Any site that claims the made-up handle exists gets marked unreliable, and its result is reported as needs manual check — never as a hit.

On a real run that took 10 claimed accounts down to 4 confirmed and 7 flagged for review. Other tools would have reported all 10.

The same idea runs through the whole report: a check that failed says so. Silence is never shown as "you're clean". A site being down, GitHub rate-limiting you, a country domain with no lookup service — each one produces an explicit "couldn't check this, which is not the same as nothing being there" line. A privacy report that quietly hides what it couldn't test is worse than no report.


What it won't do

This is a self-assessment tool. Run it on identifiers you own, or ones you've been clearly authorised to check.

It's deliberately not a people-search engine. It tells you where you appear and how to get removed. It doesn't build profiles of other people, collect anyone else's data, or scrape the sites in the registry — that half is a checklist of links and contacts. You look; it doesn't.

Other limits:

  • It can't see inside sites that need a login or payment. Those are on the manual worklist.
  • Finding nothing isn't proof there's nothing. Read the informational section of the report.
  • Search-engine queries are written for you to run yourself. Automating them breaks every search engine's terms and gets you rate-limited within a page.
  • Not legal advice.

Licence

MIT — see LICENSE.

About

Map your own public exposure using only free, accountless checks. Shows where you appear and how to get removed, never passwords or address data. Ranks a 277-site removal worklist. Companion to data-deletion-skill.

Topics

Resources

Stars

0 stars

Watchers

0 watching

Forks

Releases

Packages

Contributors

Languages