osintkit 0.11.1

Declare SHA-1 intent for the Pwned Passwords protocol and dismiss the resulting CodeQL alert as protocol-mandated.

osintkit 0.11.0

Container image.

Multi-stage build on python:3.12-slim, non-root uid 10001, entrypoint that fixes mounted volume ownership and drops privileges, healthcheck, and GHCR publishing on main and tags.

docker build -t osintkit .
docker run --rm -it -e OPENROUTER_API_KEY=... -v "$HOME/.osintkit:/data" osintkit lookup --domain example.com

docs/docker.md records the systemd-resolved host-DNS failure mode where container HTTPS hangs — use --network host there.

osintkit 0.10.1

Hardening: workflow actions pinned to commit SHAs, a weekly pip-audit job over the lockfile, and NO_COLOR support covered by a test.

osintkit 0.10.0

Linux, macOS, and Windows.

Config now lands in the right place per platform (APPDATA, Application Support, or XDG), watch notifications fall back to a PowerShell toast or osascript, and CI runs the suite on all three.

batch also refuses files over 100 targets unless --limit raises or removes the cap, so a stray huge CSV does not quietly start hundreds of runs.

osintkit 0.9.0

Three gaps closed.

Confidence per section. Every section now states low, medium, or high, capped by how many sources actually back it — a single weak index can no longer read as certain.

Offline passwords. osintkit password --offline checks a bundled 10k common-password list with no network at all.

New targets. Phone numbers resolve region, carrier, line type, and timezone entirely offline via libphonenumber; Bitcoin addresses report balance and transaction history from Blockstream. Both are keyless.

Usage: osintkit lookup --phone +14155552671, osintkit lookup --crypto bc1…

osintkit 0.8.0

Ongoing checks instead of one-off snapshots.

osintkit watch --domain example.com --every 1d prints a baseline, then stays silent unless something moves: a new breach, a new host, a risk change, or a source failing or recovering. Optional desktop notification through notify-send. --cycles bounds it, ctrl-c stops it, and every cycle is archived.

Placeholders: --no-notify for cron, --full to print the whole report on a change, --offline to watch without a model.

osintkit 0.7.0

More keyless breach depth, and the report now checks itself.

XposedOrNot's analytics endpoint returns dated, verified membership plus paste hits without any key — the gap a missing HIBP subscription leaves is now much smaller.

After synthesis, every breach name, date, subdomain, and account URL is matched back against the data actually collected. Anything the model asserted that no source returned appears in a "not found in source data" note instead of passing as fact.

osintkit 0.6.0

Info-stealer infections, which is the leak signal that actually matters.

Hudson Rock's keyless endpoint reports machines infected by stealers that saved credentials: date, hostname, IP, antivirus state, and masked logins. Queried for emails, usernames, and domains. Any infection forces a high risk floor and a "change every password on that machine" recommendation.

Example on a throwaway address: 5 infections dated 2026-10-31 alongside 15 credential-bearing breaches, summarised with the caveat that masked logins cannot be tied to the address conclusively.

osintkit 0.5.0

Breaches that read like incidents, plus password checks.

Breach names are joined against the keyless HIBP and XposedOrNot catalogues for date, exposed fields, domain, and record count, so rows say "LinkedIn, 2021-06, emails and password hashes" rather than a bare word. osintkit password checks Pwned Passwords by SHA-1 prefix — hundreds of millions of leaked passwords, no key, no plaintext leaving the machine.

Email lookups now also inspect their own domain's DNS, mail posture, and WHOIS, marked as derived.

Reasoning models returned empty replies on oversized prompts; truncation is now detected and retried, the prompt is capped at 15 rows, and a failed synthesis falls back to a local report instead of nothing.

osintkit 0.4.0

Set a key once.

osintkit init asks for a provider, stores the key at ~/.config/osintkit/config.toml (mode 600), and verifies it with a one-token request. After that, osintkit lookup alice@example.com needs no flags or exports. Environment variables still override the file for one-off runs.

osintkit config shows stored values masked, --reveal shows the key, --unset removes one, --path prints the location.