Exposure findings

Review the active case findings with evidence, risk signals, and remediation posture. Authorized local records are redacted in public views.

Data mode

authorized_local

client_not_selected

Findings

case-state store

Evidence

configured

Connectors

authorized adapters

OSINT connector suite

Authorized-source adapters for ACE correlation mapping, Sherlock, SpiderFoot, Epieos, IntelTechniques, Hunchly, Overpass Turbo, and public filings. Local and bounded adapters can persist findings, evidence, and kanban tasks; provider/manual adapters create human-review work with source links.

Select client first

Runnable

Human review

Needs config

Select a client to run adapters

ACE correlation map

correlation-analysis · local-analysis

Runnable

Local graph-aware correlation risk model over the authorized client identifier set. It recommends human-approved exposure reduction, not automated metadata poisoning.

full_namephoneemailaddresshandlebusiness_entitydomainalias

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Sherlock Project

identity-correlation · local-cli

Needs config

Username correlation across public sites when a local Sherlock CLI is installed.

handlealias

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: SHERLOCK_BIN

SpiderFoot

identity-correlation · local-cli

Needs config

Local SpiderFoot CLI/service bridge for approved identifiers. The route records a task unless a local command is configured.

domainemailbusiness_entityfull_name

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: SPIDERFOOT_BIN

Epieos

identity-correlation · human-review

Human review

Email and phone OSINT provider. Treated as human-review unless an approved server API contract is added.

emailphone

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: EPIEOS_API_KEY

IntelTechniques automation

checklist · local-analysis

Runnable

Backend source-playbook automation inspired by public OSINT workflows. Cloak owns the query generation, evidence linking, and human approval tasks.

full_namephoneemailaddresshandlebusiness_entitydomain

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Hunchly

capture · local-export

Runnable

Local Hunchly export ingestion. Uses HUNCHLY_EXPORT_DIR when a desktop capture export is available.

evidence_export

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: HUNCHLY_EXPORT_DIR

Overpass Turbo

geo · bounded-http

Runnable

Bounded OpenStreetMap address-surface review for authorized address identifiers.

address

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Public filings / PACER

public-records · human-review

Human review

Business/entity public-records review queue with SEC EDGAR and PACER source links.

business_entitydomainfull_name

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Recovery-answer exposure review

checklist · local-analysis

Runnable

LLM-assisted defensive review queue for public clues that may weaken account recovery questions. It generates review opportunities, not secret answers.

full_namephoneemailhandlealias

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

OSINT review queue

Source links, recovery-clue categories, provider checks, and human-review tasks produced by the connector suite. The queue records what to review and why; it does not store secret-answer values.

Open Kanban

Review links

Human tasks

Recovery clues

No connector-generated review links are available for this client yet. Run OSINT adapters or recovery-clue review from the operator workbench.

OSINT run ledger

Completed adapter runs from Postgres. Public rows redact protected identifiers and artifact URLs; protected operator APIs can read full run details.

0 recent

No OSINT runs are persisted for this client yet. Run the authorized adapter suite from the workbench.

ID	Finding	Severity	Confidence	Status	Risk
No findings match your filters.

0 of 0 findings · click a row to open the evidence drawer