OSINT Forge v0.8.1

OSINT Forge 0.8.1

OSINT Forge 0.8.1 is a focused patch release for the v0.8 correlation and
confidence line. It preserves the v0.8 product contract and ships the
concurrent case-edit protection validated after v0.8.0.

Fixed

• Serialize concurrent target additions to the same case with a per-case
  advisory lock.
• Preserve all unique updates when multiple workers modify one case at nearly
  the same time.
• Prevent silent lost updates while retaining atomic, owner-only case files.

Validation

The deterministic regression fixture performs 16 simultaneous unique case
additions and verifies that every addition survives. The exact release change
was validated by hosted CI on Python 3.10, 3.11, 3.12, and 3.13, plus clean
Debian stable and Ubuntu 24.04 installation and integration jobs.

Scope

This release contains no v0.9 feature work. Automatic provider selection using
expected information gain and automatic verification/enrichment plugin
dispatch remain explicit v0.9 commitments.

For the complete v0.8 feature set, see the v0.8.0 release notes.

OSINT Forge 0.8.0

OSINT Forge 0.8.0

OSINT Forge 0.8.0 is the released correlation and confidence waypoint on the
committed roadmap to v1.0. It was published on August 5, 2026.

Highlights

• Import versioned search-provider JSON with
  osint case observe CASE PROVIDER INPUT. Forge validates and preserves the
  evidence offline; it does not fetch results or execute the provider.
• Execute an explicitly selected, versioned argv-based provider adapter for
  compatible case seeds with osint case search CASE ADAPTER.
• Inspect a deterministic, provenance-linked graph with
  osint case intelligence CASE or --json.
• Correlate provider observations without dropping source history,
  contradictions, or underlying-source dependence. Case seeds and plugin
  candidates remain available in their existing entity/report views.
• Represent evidence-backed relationships and separate observation,
  relationship, identity, and currentness confidence.
• Keep verification status distinct from confidence and disclose when a
  compatible verification tool is unavailable or failed.
• Classify temporal state independently from identity support.

Provider evidence is the primary discovery layer in this release. Existing
plugins continue as optional verification and enrichment sensors. Automated
inferences expose their evidence, method, timestamp, source-independence
assumptions, contradictions, contribution, and rationale; they remain separate
from analyst-confirmed intelligence.

Compatibility and boundaries

Existing case, plugin, workflow, reporting, integrity, and export behavior is
preserved through additive versioned contracts. Provider ingestion is strict
and fail-closed. Owner-only case permissions and conservative shareable
redaction extend to the new evidence and graph data.

Version 0.8 does not automatically select providers, run newly applicable
plugins, recursively pursue discovered entities, or produce the final v1.0
profile. Controlled recursive discovery and its budgets and stopping rules
remain scheduled for v0.9.

See Correlation and Confidence,
Case Management, and the
Roadmap to v1.0.

OSINT Forge v0.7.0

Highlights

OSINT Forge v0.7.0 combines the v0.6 planning layer with v0.7 evidence integrity and portability.

• Adds versioned, deterministic investigation workflows and explainable multi-seed planning.
• Adds the conservative built-in public-identity workflow with bounded concurrency and timeouts.
• Adds SHA-256 integrity manifests that detect missing, modified, and unexpected case artifacts.
• Adds deterministic full-fidelity exports, conservative redacted bundles, independent inspection, and safe owner-only import.
• Preserves provenance, workflow digests, entity-source bindings, timestamps, and versioned contracts.
• Rejects path traversal, symbolic links, special files, duplicate archive members, corruption, schema mismatches, and unsafe overwrites.
• Fixes controlled handling of corrupt bundles and durable release-QA resume state.

Validation

The exact release commit 57b4c253ee30dba425cbe3b4f98666624deb56d1 passed:

• Debian 13.6 live validation
• 17/17 release-harness gates
• 106 Python tests
• All seven exact-commit hosted CI jobs
• Both CodeQL analyses
• Evidence-manifest verification
• Functional, regression, failure, interruption/resume, concurrency, security, privacy, permissions, packaging, installation, upgrade, uninstall, and documentation checks

Integrity verification is tamper-evident. It does not claim authenticity, forensic certification, or legal chain of custody.

See CHANGELOG.md for complete details.

OSINT Forge v0.5.0

OSINT Forge v0.5.0 advances the project from raw tool execution toward entity-aware, provenance-linked intelligence workflows—the halfway point on the committed path to v1.0.

Highlights

• Introduces versioned schema-2 plugin contracts declaring accepted and emitted entity types.
• Adds deterministic candidate-entity extraction and the new osint case entities projection while keeping observations distinct from identity conclusions.
• Adds a governed theHarvester 4.11.1 integration with restrained passive defaults and deterministic domain, email, and IP extraction.
• Upgrades normalized reporting with candidate observations and traceability-integrity status while retaining schema-1 normalizer compatibility.
• Adds a resumable, exact-commit QA harness with fail-closed gates, atomic checkpoints, archive validation, hosted-check enforcement, private evidence, and tamper-evident manifests.
• Adds the canonical v1 product contract defining the three-seed-to-profile trajectory, confidence scopes, temporal status, bounded recursion, stopping conditions, and measurable accuracy criteria.

Validation

The exact release commit 72b517d505766647696f98d1f56a53d8edd712b2 passed the complete 17-stage release harness on Debian 13.6, 97 tests, all seven hosted CI jobs, two CodeQL analyses, archive parity, upgrade and clean-install paths, all eight plugin contracts, controlled live plugin execution, security/privacy/permissions checks, interruption and resume, reporting, redaction, uninstall preservation, and exact-candidate reinstall.

Upgrade

Pull the current main branch or download the v0.5.0 source archive, then run:

sudo ./scripts/install-framework.sh
osint --version
osint forge validate
osint forge doctor

See the complete changelog for the full release history.

OSINT Forge must be used only with lawful authorization. Raw tool output and candidate entities are leads, not verified identity conclusions.

OSINT Forge v0.4.0

OSINT Forge v0.4.0

OSINT Forge v0.4.0 adds deterministic normalized reporting and the first
canonical seed-entity contract while retaining raw evidence and complete
provenance.

Highlights

• Generate consistent JSON, Markdown, HTML, and CSV reports from supported
  plugin output.
• Trace every normalized finding to its target, command, run, source file, and
  preserved raw-output directory.
• Retain completed, failed, and previewed outcomes plus explicit normalization
  errors.
• Add analyst confidence and notes without treating tool output as verified
  fact.
• Create conservatively redacted shareable reports that still require human
  review.
• Project name, email, username, phone, address, domain, IP, file, and image
  targets into deterministic canonical seed entities.
• Rerun completed jobs when the owning plugin contract version changes.

Compatibility and safety

Version 0.4 remains compatible with v0.3.1 case schema 1 and migrates legacy
unversioned cases as before. Raw evidence is not replaced by normalized data.
Canonical equality is not identity proof. Network and OSINT tools remain
subject to authorization requirements; only investigate targets you are
legally and organizationally authorized to examine.

Reports, reviews, case state, and intermediate adapter artifacts use owner-only
permissions. Normalizer, raw-evidence, report, and case paths reject unsafe
symbolic-link or boundary traversal.

Install

git clone --branch v0.4.0 https://github.com/LizardPope1101/osint-forge.git
cd osint-forge
chmod +x bootstrap.sh
./bootstrap.sh

Existing users may fetch the tag and rerun ./bootstrap.sh; framework files
are replaced atomically while configuration, case data, and independently
installed plugins are preserved.

Full changes: https://github.com/LizardPope1101/osint-forge/blob/v0.4.0/CHANGELOG.md

OSINT Forge v0.3.1

OSINT Forge v0.3.1 is a security and reliability patch release focused on protecting case data and hardening real-world plugin execution.

Highlights

• Hardens case metadata, private logs, output directories, generated reports, interrupted runs, and framework replacement/removal.
• Makes pipx-installed tools consistently discoverable throughout install, update, remove, doctor, and execution workflows.
• Enforces owner-only output for adapters, batch runs, Recon-ng, and SpiderFoot.
• Adds UTC batch identifiers and reliable concurrent/resumable execution behavior.
• Completes SpiderFoot support on Debian 13 / Python 3.13 with native build dependencies, an isolated lxml compatibility overlay, and a working-directory-independent launcher.

Install

git clone --branch v0.3.1 https://github.com/LizardPope1101/osint-forge.git
cd osint-forge
chmod +x bootstrap.sh
./bootstrap.sh

Upgrade an existing clone

cd osint-forge
git fetch --tags
git checkout v0.3.1
sudo ./scripts/install-framework.sh

Safety

Use OSINT Forge only for lawful, authorized research. Limit network scanning to systems you own or have explicit permission to assess. Raw tool output is not a verified finding; validate every lead independently. Never commit targets, credentials, cookies, tokens, case data, reports, or investigation artifacts.

See the complete changelog.

OSINT Forge v0.3.0

OSINT Forge v0.3.0

OSINT Forge v0.3.0 introduces private, resumable case management for authorized investigations.

Highlights

• Create versioned cases with documented purpose and authorization scope
• Add validated username, email, domain, IP, image, and file targets
• Run compatible installed plugins against case targets
• Resume partial work by skipping successful jobs and retrying failed or missing jobs
• Preserve planned commands, framework and plugin versions, timestamps, exit status, and raw output
• Maintain an append-only activity log
• Separate raw output, analyst notes, and reviewed findings
• Generate provenance-linked Markdown execution summaries
• Migrate legacy case metadata and reject unsupported future schemas
• Enforce owner-only permissions for all case artifacts
• Protect case metadata, activity logs, raw records, and custom reports from accidental overwrite

Case workflow

osint case create example-case \
  --purpose "Authorized investigation" \
  --authorization "Written authorization from Example Organization"

osint case add example-case username example_handle
osint case run example-case --plugins maigret sherlock
osint case status example-case
osint case report example-case

Installation

git clone --branch v0.3.0 https://github.com/LizardPope1101/osint-forge.git
cd osint-forge
./bootstrap.sh

Only use OSINT Forge for lawful, authorized investigations.

OSINT Forge v0.2.0

OSINT Forge v0.2.0

The first reliability-focused release of OSINT Forge.

Highlights

• Modular catalog with seven initial OSINT tool integrations
• Framework and plugin installation, updating, removal, and diagnostics
• Parallel batch processing for usernames, emails, domains, IP addresses, and files
• Plugin contract validation
• Owner-only permissions for target data, logs, and results
• Safe argument handling and lifecycle path validation
• Staged framework upgrades that remove obsolete files
• Clean installation testing on Debian stable and Ubuntu 24.04
• Automated testing across Python 3.10 through 3.13
• GPL-3.0-or-later licensing, security policy, and contributor documentation

Included plugins

• ExifTool
• GHunt
• Maigret
• Nmap
• Recon-ng
• Sherlock
• SpiderFoot

Installation

git clone --branch v0.2.0 https://github.com/LizardPope1101/osint-forge.git
cd osint-forge
./bootstrap.sh

Only use OSINT Forge for lawful, authorized investigations.