Find out where you already are online, before you try to leave.
Give it your own email, username, domain or GitHub handle. It checks where those show up publicly, ranks the findings by how much damage each one could do, and tells you how to get removed from each.
Companion to data-deletion-skill. That one removes you. This one tells you what there is to remove.
Python · MIT licensed · by 0nicell
Live checks run automatically. They only look at places that publish you, with no account and no scraping:
| Check | What it finds |
|---|---|
| Gravatar | A public photo and profile tied to your email address |
| GitHub commit emails | Your real address baked permanently into public commits |
| Handle enumeration | The same username across 28 platforms, linking accounts you thought were separate |
| WHOIS / RDAP | Your contact details published for domains you own |
| Certificate transparency | Every subdomain you ever issued a certificate for — staging, admin, client previews |
| Wayback Machine | Contact details you deleted from your site but not from the archive |
| Have I Been Pwned | Which breaches you're in and what was exposed (needs an API key) |
A worklist is generated from the 314-company registry in data-deletion-skill: every live site, ranked by how much harm it enables, with a working removal contact attached.
Registry 277 live sites to check (37 defunct/contactless)
CRITICAL 68 breach search + infostealer/threat-intel corpora
HIGH 65 people search, major brokers, electoral-roll directories
MEDIUM 96 B2B contact data, OSINT email intelligence
LOW 48 ad-tech segments, email verification
You get report.md and findings.json. Hand the markdown to data-deletion-skill and it writes the removal requests.
git clone https://github.com/0nicell/exposure-audit.git
cd exposure-audit
pip install requests pyyamlTo use it as a Claude skill instead:
git clone https://github.com/0nicell/exposure-audit.git ~/.claude/skills/exposure-auditThe basic run:
python3 exposure_audit.py --email you@example.com --username yourhandle \
--domain yoursite.com --github yourhandleSave your details in a file instead of retyping them:
cp profile.example.yml profile.yml && $EDITOR profile.yml
python3 exposure_audit.py --profile profile.ymlprofile.yml is gitignored. Keep it that way.
Include breach data — needs a Have I Been Pwned key, around $4/month:
python3 exposure_audit.py --email you@example.com --hibp-key "$HIBP_API_KEY"Just the worklist, no internet checks:
python3 exposure_audit.py --email you@example.com --registry-onlyCategories are scored by the damage they enable, not by how creepy they feel:
| Level | What it means | Example |
|---|---|---|
| CRITICAL | Your passwords | Breach-search engines, malware log dumps. Someone takes over your accounts |
| HIGH | The physical world | Home address, relatives, electoral roll. A safety problem |
| MEDIUM | Your identity graph | Name, employer, and the jump from your email to your accounts |
| LOW | Ad targeting | Hashed IDs and guesses about your behaviour. Real, but not a lever against you |
Every run tests itself first.
Several platforms return "page found" for usernames that don't exist. Simple username-checking tools read that as a real account and hand you a list of profiles you never created.
So before checking your handle, this tool checks a made-up one. Any site that claims the made-up handle exists gets marked unreliable, and its result is reported as needs manual check — never as a hit.
On a real run that took 10 claimed accounts down to 4 confirmed and 7 flagged for review. Other tools would have reported all 10.
The same idea runs through the whole report: a check that failed says so. Silence is never shown as "you're clean". A site being down, GitHub rate-limiting you, a country domain with no lookup service — each one produces an explicit "couldn't check this, which is not the same as nothing being there" line. A privacy report that quietly hides what it couldn't test is worse than no report.
This is a self-assessment tool. Run it on identifiers you own, or ones you've been clearly authorised to check.
It's deliberately not a people-search engine. It tells you where you appear and how to get removed. It doesn't build profiles of other people, collect anyone else's data, or scrape the sites in the registry — that half is a checklist of links and contacts. You look; it doesn't.
Other limits:
- It can't see inside sites that need a login or payment. Those are on the manual worklist.
- Finding nothing isn't proof there's nothing. Read the informational section of the report.
- Search-engine queries are written for you to run yourself. Automating them breaks every search engine's terms and gets you rate-limited within a page.
- Not legal advice.
MIT — see LICENSE.