find-leaks-in-the-wild
Installation
SKILL.md
Find leaks in the wild
This is where data surfaces before anything indexes it, and where most of what you find is a recombination of things that leaked years ago. Two mistakes cost people most: assuming a paste host's own search will find pastes, and reporting a combolist as a breach. The first wastes a day; the second is a factual error in a deliverable and it will be found.
Where to start with what you're holding
| You have | Start with | Why |
|---|---|---|
| An email or username | A curated breach service first | Cheap, attributed, and answers most questions — what-leaked-about-you |
| A selector you think is circulating now | site: sweep of paste hosts, then a paste aggregator |
Engines are shallow but free; aggregators reach what was never crawled |
| A paste that has been deleted | A historical paste corpus | Deletion is the norm; some services retain the content |
| A claimed breach of a named company | The company's own disclosure, then a regulator notification | One authoritative source beats any amount of forum chatter |
| A dataset being advertised | Structural analysis of the sample | You almost never need the full dataset to answer the question |
| A domain you're defending | Vendor monitoring plus your own canary selectors | One-off searches miss everything posted between them |