whatleaks 0.1.1

No changes to the command-line tool. 0.1.1 brings the npm page up to date: the README
now opens with a demo GIF, links https://whatleaks.me and gives the Homebrew install.

• Demo. The GIF (two comparisons on next build) and the
  55-second video replay real output of
  0.1.0 from npm, recorded on 2026-10-24. With DO_NOT_TRACK=1, Next.js 16.4.2 still sent
  8 of its 8 telemetry requests; with its documented switch, NEXT_TELEMETRY_DISABLED=1,
  it sent none. That matches the runs from 2026-10-21. Transcripts:
  docs/e2e/published-0.1.0/.
• Homebrew: brew install devanshranjan10/tap/whatleaks.
• In the repo: SECURITY.md (private vulnerability reporting is on),
  CONTRIBUTING.md, CHANGELOG.md and issue forms.
• Published from GitHub Actions through npm trusted publishing, with provenance. No
  npm token is stored in the repo.

Install: npx whatleaks run -- <command>, npm install -g whatleaks or
brew install devanshranjan10/tap/whatleaks. Needs Node ≥ 22.12.

whatleaks 0.1.0

See what an app you run sends home, and what it still sends after you opt out.

whatleaks runs a command through a local, single-run proxy and reports where its traffic
went, how often, which fields each payload carried, and whether any of it is about you:
your username, hostname, home path, MAC address (also as a hash), machine id or git email.

Headline. In a lab with exact ground truth (46 scenarios and 594 attempts on macOS,
43 and 567 on Linux), whatleaks silently missed 3.4 % of attempts on macOS and 3.0 % on
Linux. mitmproxy 12.2.3, given the same environment, missed 38 % and 40 %. HTTP Toolkit
server 1.27.3, with its own interception, missed 67 % and 70 %. Every miss left is in a Go
program, which whatleaks loads no hook into. See
docs/BENCHMARK.md.

What's in 0.1.0

• whatleaks run captures one run and prints a report. Each run also saves the raw
  capture as a HAR file that only you can read.
• whatleaks compare runs the command twice, first with defaults and then opted out of
  telemetry, and shows what is still sent. --strict exits 1 if a known telemetry
  endpoint is still contacted, for CI.
• whatleaks report and whatleaks diff analyse HAR files, from whatleaks or
  another tool.
• Trust stays inside the app's process tree. Each run makes a fresh CA and a proxy on
  127.0.0.1 only. Nothing is installed in the system trust store, and no system proxy
  setting changes.
• Hooks for Node, Python and Ruby route clients that ignore proxy variables
  (node:http2, aiohttp), and report each direct TCP connection and UDP destination as it
  opens.
• Connections that bypass the proxy are listed by address and process, using
  netstat on macOS and /proc on Linux.
• Reports are redacted for sharing. This machine's identifiers become labels, secrets
  become ‹redacted›, and ids become per-report aliases. Redaction is pattern-based, so
  read a report before you post it. --raw turns it off.
• A catalog of 69 known telemetry hosts, each with a source link. Keyword guesses are
  marked ? and never count toward headlines or --strict.

Also measured

• No false attributions: in every run, nothing the app did not send was credited to it.
• All 8 planted identifiers were found in every run, and none of the 4 decoys was flagged.
• Real tools, checked against each tool's own debug output: whatleaks matched 5 of 5,
  HTTP Toolkit 4, mitmproxy 3.
• Next.js 16.4.2 with DO_NOT_TRACK=1 still sent 8 telemetry requests. Its documented
  switch, NEXT_TELEMETRY_DISABLED=1, took that to 0.

Limits

• macOS and Linux only. Windows has no process-watching backend yet.
• Apps that refuse the CA, such as pinned clients and Go programs on macOS, are named and
  counted but not read. whatleaks does not try to get around pinning.
• The full list, with measured numbers, is under
  Limitations.

Install: npx whatleaks run -- <command> or npm install -g whatleaks. Needs Node ≥ 22.12.