v1.5.0

user-scanner v1.5.0 — 2026-08-13

This release collects merged changes since v1.4.3.1. It focuses on reliability and accuracy fixes across many modules, profile enrichment improvements, and a major cross-scan workflow that lets you pivot finished scans into focused username and email scans and score each hit.

Notable changes

Cross-scan workflow

• feat(cross-scan): pivot finished scans into username and email scans, and rate each hit (#559) — by @brunolm; reviewed by the team.
  • New "cross-scan" flow: after a scan finishes, you can run a targeted pivot that splits results into username and email scan tasks, re-checks hits with specialized modules, and assigns a confidence rating to each discovered item.
  • Helps prioritise follow-ups and reduces manual triage by surfacing higher-confidence matches first.
  • CLI and docs updated with usage and interpretation guidance for cross-scan results.

Features & enhancements

• feat: add Tinder username module (#560) — by @kristoisberg.
• feature: Andele Mandele username module (#572) — by @kristoisberg.
• feat(email_scan): add several new email modules (multiple PRs, incl. #508, #495, #573) — by @kaifcodec and contributors.
• feat(core): add impersonate_request_async to make email modules non-blocking and improve throughput (#528).
• feat(pdf): parallelize profile photo downloading with a progress bar for faster PDF reports (#506).
• feat(gravatar): further enrich profile extraction (links, interests, profile details) (#516).

Bug fixes & accuracy improvements

• fix: resolve core engine concurrency hangs (#571) — avoids scan stalls under heavy parallel load.
• Wide-ranging module fixes that improve verdict accuracy and clear challenges/WAF/Captcha for lookups (GitHub, Facebook, Medium, Patreon, etc.). These reduce false positives and restore modules previously unable to return verdicts.
• fix(cli): prevent bandwidth waste on invalid output formats (#502).
• fix(core): display and export the media dictionary in console, JSON, and CSV outputs so avatar/media URLs are preserved (#517).
• Numerous small but important fixes to restore and harden modules that previously returned spurious results or errors (see detailed PR list).

Documentation

• chore/docs: add contributor guides and small docs improvements; README sync and layout refinements (#505, #570).
• Updated CLI help and docs to cover cross-scan usage and result rating.

Tests, CI & maintenance

• Continued test additions and maintenance (flake/nix dependency fixes, refactors separating media from extra, and CI stability tweaks) — examples: #513, #496.
• Housekeeping: retire permanently-offline modules to abandoned/ (#525), various cleanups.

---

Detailed merged PRs included in v1.5.0 (merged after v1.4.3.1)

• #504 — fix: Steam user module errors
• #519 — fix: BentBox username module errors
• #520 — fix: resolve BDSM Singles browser challenge
• #521 — fix(user_scan): restore 11 modules that could never return a verdict
• #522 — fix: batch execution for multi-module scan progress bar
• #523 — fix(bentbox): detect profiles via the ProfilePage JSON-LD
• #524 — fix: unblock apexlegends, buzzfeed, cups7 and flickr
• #525 — chore: retire Motherless modules to abandoned/ (site is offline)
• #528 — feat(core): add impersonate_request_async for the email modules
• #529 — fix(wordpress): treat email_login_not_allowed as a registered account
• #530 — fix(deezer): key the verdict on the email constraint alone
• #531 — fix(nytimes): recognise show-welcome-back as a registered account
• #532 — fix(nextdoor): name the geo null-route instead of a raw resolver error
• #533 — fix(kick): route the signup check through the impersonating transport
• #534 — fix(fapfolder): route the signup check through the impersonating transport
• #535 — fix(patreon): clear the 403 and recognise the sso_required auth step
• #536 — fix(letterboxd): clear the challenge that served HTML where JSON was expected
• #537 — fix(classmates): clear the WAF 403 on the login handshake
• #538 — fix(walmart): clear the 412 session mismatch
• #539 — fix(pornhub): probe a sub-addressed alias to get a verdict again
• #540 — fix(github): find accounts via the search API when signup is challenged
• #541 — fix(spankbang): impersonate Safari to clear the Cloudflare challenge
• #542 — fix(facebook): follow canonical-casing redirects and match both miss wordings
• #543 — fix(livejournal): resolve journals, and split purged from suspended
• #544 — fix(defensivecarry): confirm a miss instead of inferring it from a bare 200
• #545 — fix(thefirearmsforum): confirm a miss instead of inferring it from a bare 200
• #546 — fix(producthunt): confirm a hit on the profile title instead of a bare 200
• #547 — fix(annaabi): name the Cloudflare challenge instead of emitting a bare 403
• #548 — fix(donatello): confirm a creator page instead of returning taken on any 200
• #549 — fix(yaga): name the CloudFront country block instead of a bare 403
• #550 — fix(advfn): clear the Cloudflare wall blocking every lookup
• #551 — fix(babepedia): clear the Cloudflare wall blocking every lookup
• #552 — fix(bdsmlr): resolve blogs through the site API
• #553 — fix(medium): match the served handle and follow subdomain redirects
• #554 — fix(stackoverflow): verify the fragment before returning a verdict
• #555 — fix(riot-id): require a boolean verdict from the lookup API
• #556 — fix(bdsmsingles): stop reporting every handle as free
• #557 — fix(annaabi): name the Cloudflare challenge instead of emitting a bare 403 (followup)
• #558 — fix(chess_com): resolve mixed-case handles instead of erroring on the 301
• #559 — feat(cross-scan): pivot a finished scan into username and email scans, and rate each hit
• #560 — feature: Tinder username module
• #563 — fix(reddit): stop naming a boolean flag after an email field
• #564 — fix(gitlab): publish the account's public email
• #565 — feat(devto): extract the linked github and twitter handles
• #566 — feat(liberapay): extract the OAuth-verified accounts the profile vouches for
• #567 — feat(ifttt): extract the profile instead of discarding the response
• #568 — feat(flickr): extract the profile's linked social accounts
• #569 — fix(monkeytype): stop reporting real accounts as errors, and extract the profile
• #570 — docs: sync README with main features and refine layout
• #571 — fix: resolve core engine concurrency hangs
• #572 — feature: Andele Mandele username module
• #573 — feat(email_scan): add asafeer, tatacliq, couplejoy, lovenudge modules

---

Credits

Thanks to all contributors and reviewers for this batch of changes: @brunolm, @kaifcodec, @kristoisberg, @VamatoHD, @json-hunter07, @A-S-Manoj, @beranka, @w3lld1, and others.