Passive OSINT

When it applies

Early recon, and anytime you want surface/intel without sending traffic to the target — safest, often highest-signal (leaked keys, forgotten hosts, exposed services).

Why it works

Organizations leak everywhere but their own site: search-engine indexes, public code, internet scan databases, cloud metadata, and employee footprints. Aggregating these finds assets and secrets the target doesn't know are exposed.