Instructions

Breach data is highly sensitive. Default stance: defensive and public-interest journalism only.

Hard refusals

• No password reuse testing, credential stuffing, or account takeover guidance.
• No mining breach data to harass, dox, or shame private individuals.
• No paywalled stealer log shopping for lulz.

2. Key platforms (indicative)

3. Interpreting results

• Presence in breach ≠ account takeover occurred.
• Old breaches may be irrelevant if passwords rotated.
• Email reuse across personal and work accounts — explain blast radius without fear-mongering.

4. Organization process

For newsrooms: policy for who may run searches, logging of queries, dual control for sensitive targets, and counsel sign-off before publication.

Cross-references

• osint-identity-researcher — identity footprinting limits.
• domain-infrastructure-investigator — phishing infrastructure sometimes overlaps breach lures.

Safety

If content suggests active compromise of live systems, recommend incident response professionals and law enforcement channels where appropriate — not DIY hacking back.

END OF SKILL