Exposure findings

Review the active case findings with evidence, risk signals, and remediation posture. Authorized local records are redacted in public views.

No active client context

Select or create a real customer case

Cloak Harbor does not load an arbitrary person by default. Select a saved client or start onboarding before reviewing evidence, OSINT results, actions, reports, or schedules.

Start onboarding Choose client

Data mode

authorized_local

client_not_selected

Findings

case-state store

Evidence

configured

Connectors

authorized adapters

OSINT connector suite

Authorized-source adapters for ACE correlation mapping, Sherlock, SpiderFoot, Epieos, IntelTechniques, Hunchly, Overpass Turbo, and public filings. Local and bounded adapters can persist findings, evidence, and kanban tasks; provider/manual adapters create human-review work with source links.

Select client first

Runnable

Human review

Needs config

Select a client to run adapters

ACE correlation map

correlation-analysis · local-analysis

Runnable

Local graph-aware correlation risk model over the authorized client identifier set. It recommends human-approved exposure reduction, not automated metadata poisoning.

full_namephoneemailaddresshandlebusiness_entitydomainalias

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Sherlock Project

identity-correlation · local-cli

Needs config

Username correlation across public sites when a local Sherlock CLI is installed.

handlealias

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: SHERLOCK_BIN

SpiderFoot

identity-correlation · local-cli

Needs config

Local SpiderFoot CLI/service bridge for approved identifiers. The route records a task unless a local command is configured.

domainemailbusiness_entityfull_name

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: SPIDERFOOT_BIN

Epieos

identity-correlation · human-review

Human review

Email and phone OSINT provider. Treated as human-review unless an approved server API contract is added.

emailphone

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: EPIEOS_API_KEY

IntelTechniques automation

checklist · local-analysis

Runnable

Backend source-playbook automation inspired by public OSINT workflows. Cloak owns the query generation, evidence linking, and human approval tasks.

full_namephoneemailaddresshandlebusiness_entitydomain

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Hunchly

capture · local-export

Runnable

Local Hunchly export ingestion. Uses HUNCHLY_EXPORT_DIR when a desktop capture export is available.

evidence_export

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: HUNCHLY_EXPORT_DIR

Overpass Turbo

geo · bounded-http

Runnable

Bounded OpenStreetMap address-surface review for authorized address identifiers.

address

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Public filings / PACER

public-records · human-review

Human review

Business/entity public-records review queue with SEC EDGAR and PACER source links.

business_entitydomainfull_name

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

Recovery-answer exposure review

checklist · local-analysis

Runnable

LLM-assisted defensive review queue for public clues that may weaken account recovery questions. It generates review opportunities, not secret answers.

full_namephoneemailhandlealias

Project Evidence source

Runtime contract

Protected action: Runs only through allowlisted server routes with backend authorization.
External action taken: false
Required config: None

OSINT review queue

Source links, recovery-clue categories, provider checks, and human-review tasks produced by the connector suite. The queue records what to review and why; it does not store secret-answer values.

Open Kanban

Review links

Human tasks

Recovery clues

No connector-generated review links are available for this client yet. Run OSINT adapters or recovery-clue review from the operator workbench.

OSINT run ledger

Completed adapter runs from Postgres. Public rows redact protected identifiers and artifact URLs; protected operator APIs can read full run details.

0 recent

No OSINT runs are persisted for this client yet. Run the authorized adapter suite from the workbench.

ID	Finding	Severity	Confidence	Status	Risk
No findings have been collected for this case yet.Start discovery workflow

0 of 0 findings · click a row to open the evidence drawer