# socialscope — Changelog

## v1.0.0 — 2026-06-23

Initial release. Passive, ToS-respecting social-media OSINT CLI.
Sits in the `recon` category (catalogue `app=recon`) next to
`darkrecon`, `skyrecon`, and `webharvest`.

### What socialscope does

Public-HTTP-only OSINT. **Refuses by design** to scrape LinkedIn /
Instagram / TikTok / Facebook authenticated content, run headless
browsers, or store platform credentials. Output is jfind/v1 NDJSON
ready for `complymap` and `dossier` downstream.

### Subcommands

```
socialscope user <username>         # Sherlock-class username enumeration (30+ sites)
socialscope email <addr>            # Holehe-class email-existence probe
socialscope dork <target>           # search-engine dorking (DuckDuckGo HTML)
socialscope image <path-or-url>     # EXIF + GPS + camera-make extraction
socialscope verify --engagement <id> --target <…>   # orchestrator
socialscope packs list | show <name>
socialscope sites list [--category <cat>]
```

### Abuse-class gate

Three classes per-platform in the vendored data:

| Class | Default | Description |
|---|---|---|
| `ok` | ✓ | Public endpoint, ToS-permitted (GitHub / Mastodon / Bluesky / …) |
| `tolerated` | ✓ | Public profile pages OK; login automation forbidden (LinkedIn / Twitter / Instagram public URLs) |
| `strict` | ✗ | Platform classifies enumeration as abuse (Twitter legacy email-available, Instagram account-exists, Snapchat, TikTok, Facebook). Operator must pass `--include-abuse-class-strict` to opt in. |

### Data shipped (vendored, `include_str!`)

| File | Contents |
|---|---|
| `data/sites.toml` | 30 username-enumeration sites (GitHub / GitLab / Reddit / Mastodon / Bluesky / Hugging Face / Kaggle / …) |
| `data/email_sites.toml` | 7 email-existence platforms (Gravatar, GitHub Search API, GitLab Search API, Mastodon WebFinger, HIBP, plus 2 strict-default-off Twitter/Instagram legacy endpoints) |
| `data/abuse_classifiers.yaml` | Per-platform abuse-class registry |
| `data/dorks/paste_sites.yaml` | Pastebin / Ghostbin / Throwbin / rentry / Hastebin search |
| `data/dorks/social_handles.yaml` | LinkedIn / Twitter / Instagram / Reddit / HN brand-monitor dorks |
| `data/dorks/code_leaks.yaml` | GitHub / GitLab / Bitbucket / Gist credential-reference dorks |

Adding more sites / packs is a data-only release: drop a file, recompile.

### jfind/v1 mapping

Per spec §4:

| Finding | jfind category | severity | MITRE |
|---|---|---|---|
| Confirmed username | `asset-inventory` | Info | — |
| Confirmed email | `asset-inventory` | Low | — |
| Dork hit (paste/leak/code) | `data-exposure` | Medium (High if creds keyword) | T1213, T1552.001 |
| Image EXIF + GPS | `data-exposure` | Medium | — |
| Lookalike handle | `brand-impersonation` | Medium | T1583.001 |

Controls pre-filled for the consulting layer: DORA Art. 28
(third-party / vendor-leak dorks), NIS2 Art. 21(2)(d) (any
data-exposure), ISO/IEC 27001:2022 A.5.34 (PII in image metadata).

### Acceptance gates pinned by integration tests

1. `image tests/fixtures/sample_image.jpg -F json` → GPS lat 48.875,
   lon 2.3417 (≈ Paris); status `confirmed`, severity `medium`.
2. `image -F jfind --engagement-id ENG-TEST` emits valid jfind/v1 with
   the ISO 27001 A.5.34 control populated and `engagement_id` set.
3. `email test@example.com` default invocation NEVER touches a
   strict-abuse-class platform (Instagram account-exists, Twitter
   legacy).
4. `sites list -F json` returns ≥ 25 entries with GitHub present.
5. `packs list -F json` returns the three starter packs.
6. `unknown-format` → exit 3 (suite standard).
7. Missing subcommand → exit 2 (suite standard).
8. `--full` dumps every subcommand's help.

### Build

- Library crate (`socialscope`) + thin CLI binary.
- 18 unit tests + 14 integration tests = 32 tests, all green.
- Zero compiler warnings.
- Suite-standard exit codes (0 ok | 1 findings emitted | 2 usage |
  3 runtime).
- NixOS-only platform gate in `install.sh` (suite policy 2026-06-23).
- jfind/v1 native output via the path-dependency on `jfind`.

### Deferred to v1.1

- Google CSE + Bing Web Search providers (env-gated).
- TinEye + Yandex reverse image search.
- IDN homograph / lookalike-handle detection (Damerau-Levenshtein
  helper is in deps; classifier deferred).
- `--watch` mode for `verify` with NDJSON delta tracking.
- ONNX local classifier ("real profile vs. lookalike").

### What this tool will NEVER do (locked in spec §2.2)

- Scrape LinkedIn / Instagram / TikTok / Facebook authenticated content.
- Run headless-browser automation against those platforms.
- Store platform credentials.
- Distribute scraped datasets.
- Bypass rate limits, ship fingerprint-evasion logic, or rotate proxies.