exposed
Find what of your personal data is leaking online — then remove it.
exposed is a personal OSINT self-scan. Point it at your own name, emails, and
usernames, and it checks free, no-account, no-API-key public sources to show
where your information is exposed — then hands you one-click opt-out links for
the data brokers holding it.
It only ever looks you up. No targets, no accounts, no keys, no data leaves your machine except the lookups themselves.
Example scan of a fictional identity — real output is color-coded by severity.
What it checks
| Source | What it finds |
|---|---|
| Gravatar | Is your email tied to a public profile (photo, name, linked accounts)? |
| Hudson Rock | Does your email/username appear in infostealer-malware logs? |
| GitHub | Is your email leaking through public commits or linked to a user? |
| holehe (optional) | Which sites have an account registered to your email? |
| Sherlock (optional) | Which sites have an account under your username? |
| Data brokers | Ready-made search + opt-out links for 25 people-search sites |
| Search dorks | Pre-built Google / DuckDuckGo queries to eyeball the rest |
Install
pip install exposed # core scan
pip install "exposed[full]" # + holehe & Sherlock for the deeper account sweeps
Or from source:
git clone https://github.com/GreenHarvestDev/exposed.git
cd exposed
pip install -e ".[full]"
Usage
-
Copy the example config and fill in your own details:
cp exposed_identity.example.json exposed_identity.json # edit exposed_identity.json
-
Run the scan:
exposed # readable summary + saves exposed_report.json exposed --no-sherlock # skip the slow username sweep exposed --json # emit the full report as JSON (for your own UI)
Your exposed_identity.json and any *_report.json are git-ignored — they hold
your PII and should never be committed.
Identity file
{
"full_name": "Jane Q. Public",
"emails": ["jane@example.com"],
"usernames": ["janepublic"],
"phones": ["555-123-4567"],
"cities": ["Springfield"],
"state": "OR",
"aliases": ["Jane Doe"],
"relatives": ["John Public"]
}
Everything is optional — provide what you want scanned. More detail = more thorough dorks and broker links.
Ethics & scope
exposed is a defensive privacy tool. It is designed to scan your own
identity so you can reduce your attack surface and remove yourself from data
brokers. Don't use it to profile other people.
All sources are public and free; the tool sends no data to any server it doesn't have to query for a lookup, and stores results only in the local report file you control.
Development
git clone https://github.com/GreenHarvestDev/exposed.git
cd exposed
pip install -e ".[dev]"
ruff check . && ruff format --check . && pytest
Tests are fully offline (network and external tools are mocked), so pytest runs in
well under a second. See CONTRIBUTING.md — new source checks are
welcome as long as they're free, need no account, and ship with a test.
License
MIT © 2026 GreenHarvestDev
Metadata
Release files for exposed 0.1.0
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | Actions |
|---|---|---|---|---|
| exposed-0.1.0.tar.gz | 21.0 kB | With provenance | Details for exposed-0.1.0.tar.gz |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Actions Reset |
|---|---|---|---|---|
| exposed-0.1.0-py3-none-any.whl | Python 3 | none | any | Details for exposed-0.1.0-py3-none-any.whl |
Total release size: 37.9 kB
Release files / exposed-0.1.0.tar.gz
| Download URL | exposed-0.1.0.tar.gz |
|---|---|
| Size | 21.0 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
ce7b84eeadbbab51bfbc1a1b1585cff80e282db220ce29d91fe067507924a252
|
|
BLAKE2b-256 checksum How to use checksums |
cd7bb7e19ae44070f096432cb0e8623e3f4824e8c080e0fad80992cea5418eb4
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 18, 2026.
Transparency logRelease files / exposed-0.1.0-py3-none-any.whl
| Download URL | exposed-0.1.0-py3-none-any.whl |
|---|---|
| Size | 16.9 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
3330dafd0cac4307d665b6650cf27e3787b8ef33d8007268d493e51200157c41
|
|
BLAKE2b-256 checksum How to use checksums |
ced3a6c8961e91cec89d98e453b4f3e1bbbcbadbda82afc85ad2e082ba881a6c
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 18, 2026.
Transparency logSecurity for exposed 0.1.0
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for exposed-0.1.0.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jul 18, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.
To learn more about protecting yourself from malicious actors, visit our package security documentation.