Exposure-Check-OSINT v1.1.0 - exports, doctor self-test, confidence tiers

What's new in v1.1.0

1. JSON / CSV export

Download any stored check as a JSON document (full per-source detail) or a flat CSV (one row per source verdict, UTF-8 BOM so Excel opens it cleanly) - from the report page, the history table, or right after a live check. Privacy contract unchanged: identifiers stay masked, credential material is re-stripped belt-and-braces, and password checks export an honest empty-source row (k-anonymity means no per-source data exists).

2. php artisan ec:doctor - install self-test

One command verifies the whole install: PHP version and required extensions, app key, admin password, storage writability, the maigret site database, database + migration state, the 18-source registry, and live reachability of every source (parallel probe, seconds to run). Table output by default, --json for machines, exit code 1 when anything FAILs. Unreachable sources are WARN, never FAIL - same honesty as the product itself.

3. Username confidence tiers

Every username hit is now labeled confirmed (page-content or redirect verified) or probable (status-code only) on the dashboard logo grid, in the report table, and in both export formats. Older stored checks render without badges.

Also

• config/app.version was stale at 1.0.0 in the v1.0.1 release - now correct.
• Test suite grew 15 -> 27 tests (359 assertions), all hermetic (no network in CI).

Full changelog: see CHANGELOG.md

Docs: docs/SELF-HOSTING.md - PDF guides for the 5 checks, 18 sources, self-hosting, privacy and FAQ live in pdfs/.

Exposure-Check-OSINT v1.0.1 — polish + security review

v1.0.1 — the polish + security-review release. ✅ CI green on PHP 8.2/8.3/8.4.

Fixed

• Report score clarity — exposure score now shows its scale (X / 100, 100 = clean) plus a prominent risk label (CRITICAL EXPOSURE, ELEVATED, MINOR, LOW). A bare 0 was ambiguous.
• Stray UI element — the daily-quota chip no longer renders as an empty pill before the first check of the day.
• Logout session destruction — invalidate() + regenerateToken() (the old regenerate() kept the session record alive until expiry).
• Privacy contract — IP addresses are now masked in stored reports (103.***.***.12); previously the raw IP was stored, violating the "identifiers never stored raw" promise.

Changed

• README screenshots are now real live-product captures (dashboard, results view, printable report) — no mockups.

Security review

Full AI-assisted review completed (2 real findings — both fixed above; 4 other reported findings verified false and documented). Every file lints clean; the contract test suite and Docker build-context verification pass in CI.

Documentation set (attached below)

The complete PDF set — overview guide, self-hosting install guide, the 5 checks explained, the 18-source attribution list, privacy design, and FAQ.

Exposure-Check-OSINT v1.0.0 — initial Community Edition

Exposure-Check-OSINT v1.0.0 — the initial Community Edition release.

Self-hosted personal exposure checker: is your email, username, phone or password leaked? 18 keyless sources — breach collections, infostealer logs, COMB 11B+ credentials, HIBP k-anonymity, 150-platform username grid — Docker one-command install, no API keys, no AI, Apache-2.0.

What's inside

• 5 check types: email · username · phone · password (k-anonymity) · IP
• 18 keyless source adapters with per-source failure isolation
• Single-admin dashboard: parallel checks, platform logo grid, exposure-score gauge, honest three-state verdicts (exposed / clear / unavailable)
• History with per-record delete + purge-all — identifiers stored as salted hashes + masked forms only; password checks store nothing
• Printable report (browser print → PDF, no server-side PDF dependency)
• Settings: daily quota, burst limit, cache TTL, honest UA, per-source enable/disable
• Community license: 14-day full-feature trial → free key from 2mny.com
• One-command Docker install (Apache + PHP 8.3 + SQLite, single container)
• Contract test suite + CI on PHP 8.2/8.3/8.4

Why no AI?

Every verdict is a deterministic, reproducible HTTP lookup. No model, no API bill, no hallucinated findings — a source that cannot answer says unavailable instead of guessing. Full design: README.