Security Release — v3.4.0

Security Release — v3.4.0

Addresses 11 security issues reported by the community.

Fixed: SSL/TLS (#1), path traversal (#2), Sherlock integrity (#3),
MD5→SHA256 (#4), pinned deps (#5), KeyboardInterrupt (#7),
_check_deps at import (#8), XSS in report (#10), D3 SRI (#11),
stale repo in install.sh (#13), response body cap (#14)

False positive fixes:

• Default avatar pHash filtering (Mastodon silhouette = 25 fake 99% matches → now 0)
• NSFW platforms excluded by default (--nsfw flag to include)
• Hidden output directory fixed (.rxzikhx. → rxzikhx_)
• 80+ Russian/obscure forums and dead sites added to blocklist

Full details: CHANGELOG.md

Helix v3.3.0 — 3,176 platforms · PDF reports · Email permutation · Zero false positives

What's New in v3.3.0

New Features

• --email-permute — generates likely email addresses from username + extracted real name, optionally checks each with holehe
• --report — standalone HTML investigation report + PDF (pip install weasyprint)
• Real name auto-extraction from OG-verified profiles (used for email permutation)
• Sherlock fixed — updated URL for v0.16.0 repo restructure
• 3,176 total platforms with --wmn --sherlock --maigret

False Positive Fixes

• 70+ platforms added to blocked list
• Registration API trap: 41 URL patterns blocked pre-request
• Dead host pre-filter: 35 hostnames blocked before any HTTP request
• Soft-404 content detection: 45+ not-found strings
• Patriots Win, OP.GG search pages, xhamster, 15 Sherlock FPs and more

Bug Fixes

• graph.py crash fixed — int64 not JSON serializable from pHash numpy values
• Sherlock $schema key crash fixed

Install

pip install -r requirements.txt
python helix.py -u johndoe --wmn --sherlock --maigret

Full changelog

See CHANGELOG.md