Exposure Audit — Security skill for Claude Code

Exposure Audit

**Find out where you already are online, before you try to leave.**

Give it your own email, username, domain or GitHub handle. It checks where those show up publicly, ranks the findings by how much damage each one could do, and tells you how to get removed from each.

Companion to [data-deletion-skill](https://github.com/0nicell/data-deletion-skill). That one removes you. This one tells you what there is to remove.

Python · MIT licensed · by [0nicell](https://github.com/0nicell)

---

What it checks

**Live checks** run automatically. They only look at places that publish *you*, with no account and no scraping:

Check	What it finds
Gravatar	A public photo and profile tied to your email address
GitHub commit emails	Your real address baked permanently into public commits
Handle enumeration	The same username across 28 platforms, linking accounts you thought were separate
WHOIS / RDAP	Your contact details published for domains you own
Certificate transparency	Every subdomain you ever issued a certificate for — staging, admin, client previews
Wayback Machine	Contact details you deleted from your site but not from the archive
Have I Been Pwned	Which breaches you're in and what was exposed (needs an API key)

**A worklist** is generated from the 314-company registry in data-deletion-skill: every live site, ranked by how much harm it enables, with a working removal contact attached.

Registry  277 live sites to check (37 defunct/contactless)
  CRITICAL  68     breach search + infostealer/threat-intel corpora
  HIGH      65     people search, major brokers, electoral-roll directories
  MEDIUM    96     B2B contact data, OSINT email intelligence
  LOW       48     ad-tech segments, email verification

You get `report.md` and `findings.json`. Hand the markdown to data-deletion-skill and it writes the removal requests.

---

Setup

git clone https://github.com/0nicell/exposure-au