Exposure Watch is a privacy-first breach-awareness tool for people and teams who need to understand email, password, and IP exposure risk without handing sensitive data to a black box. It checks real breach and abuse data sources, then turns the result into a prioritized posture score and a concrete remediation queue — no stored passwords, no stored raw secrets.
Exposure Watch runs three defensive checks against real third-party security data sources and reports the result as a posture score with prioritized next actions:
- Email breach check — looks up an email against breach records and returns which breaches it appeared in and what data was exposed.
- Password exposure check — checks a password hash against known-compromised password ranges using k-anonymity, so the full password or hash is never transmitted or stored.
- IP abuse check — validates an IPv4/IPv6 address and checks it against abuse-reporting data.
- Posture studio — a general-purpose exposure prompt (email, domain, or scenario) that returns a scored intelligence map, an action queue (MFA review, password reset sequencing, domain watch), and contributor missions for extending the tool.
- Built on Next.js App Router with TypeScript and Tailwind CSS 4, deployed as Vercel serverless functions.
app/api/breach-checkcalls the XposedOrNot breach-analytics API server-side and returns only breach name, date, and exposed-data categories — never persists the queried email.app/api/password-checkimplements Have I Been Pwned's k-anonymity range API: only a 5-character SHA-1 prefix is sent, the full hash never leaves the request.app/api/ip-checkvalidates the address format, then checks it against AbuseIPDB when an API key is configured.app/api/intelligencepowers the posture studio on the homepage with a deterministic scoring model (no external key required), returning an exposure map, action queue, and contributor lanes.
The real problem: a password checker that sends your actual password (or its full hash) to a server is asking for the exact trust it's trying to help you verify — the tool itself becomes the leak vector.
The approach: password-check never transmits the full SHA-1 hash. It splits the hash, sends only the 5-character prefix to HIBP's k-anonymity range endpoint, and matches the suffix client-side against the returned candidate list — HIBP's servers see a prefix shared by thousands of possible passwords, never which one is yours.
One real number: a 5-character hex prefix narrows the candidate space to roughly 1-in-16^5 (~1M) possible hashes sharing that prefix — enough ambiguity that the server can't reasonably infer the original password.
Not handled yet: ip-check degrades silently to format-validation-only when no AbuseIPDB key is configured, and the homepage "posture score" widget is a decorative heuristic, not a real exposure calculation — don't read it as a security score.
exposurewatch-sigma.vercel.app
| Layer | Technology |
|---|---|
| Framework | Next.js (App Router) |
| UI | React 19, Tailwind CSS 4 |
| Language | TypeScript |
| Breach data | XposedOrNot breach-analytics API |
| Password check | Have I Been Pwned range API (k-anonymity) |
| IP reputation | AbuseIPDB |
| Deployment | Vercel serverless functions |