user-scanner v1.5.0 — 2026-08-13

This release collects merged changes since v1.4.3.1. It focuses on reliability and accuracy fixes across many modules, profile enrichment improvements, and a major cross-scan workflow that lets you pivot finished scans into focused username and email scans and score each hit.

Notable changes

Cross-scan workflow

• feat(cross-scan): pivot finished scans into username and email scans, and rate each hit (#559) — by @brunolm; reviewed by the team.
• New "cross-scan" flow: after a scan finishes, you can run a targeted pivot that splits results into username and email scan tasks, re-checks hits with specialized modules, and assigns a confidence rating to each discovered item.
• Helps prioritise follow-ups and reduces manual triage by surfacing higher-confidence matches first.
• CLI and docs updated with usage and interpretation guidance for cross-scan results.

Features & enhancements

• feat: add Tinder username module (#560) — by @kristoisberg.
• feature: Andele Mandele username module (#572) — by @kristoisberg.
• feat(email_scan): add several new email modules (multiple PRs, incl. [#508], [#495], [#573]) — by @kaifcodec and contributors.
• feat(core): add impersonate_request_async to make email modules non-blocking and improve throughput (#528).
• feat(pdf): parallelize profile photo downloading with a progress bar for faster PDF reports (#506).
• feat(gravatar): further enrich profile extraction (links, interests, profile details) (#516).

Bug fixes & accuracy improvements

• fix: resolve core engine concurrency hangs (#571) — avoids scan stalls under heavy parallel load.
• Wide-ranging module fixes that improve verdict accuracy and clear challenges/WAF/Captcha for lookups (GitHub, Facebook, Medium, Patreon, etc.). These reduce false positives and restore modules previously unable to return verdicts.
• fix(cli): prevent bandwidth waste on invalid output formats (#502).
• fix(core): display and export the media dictionary in console, JSON, and CSV outputs so avatar/media URLs are preserved (#517).
• Numerous small but important fixes to restore and harden modules that previously returned spurious results or errors (see detailed PR list).

Documentation

• chore/docs: add contributor guides and small docs improvements; README sync and layout refinements (#505, [#570]).
• Updated CLI help and docs to cover cross-scan usage and result rating.

Tests, CI & maintenance

• Continued test additions and maintenance (flake/nix dependency fixes, refactors separating media from extra, and CI stability tweaks) — examples: [#513], [#496].
• Housekeeping: retire permanently-offline modules to abandoned/ (#525), various cleanups.

Detailed merged PRs included in v1.5.0 (merged after v1.4.3.1)

• [#504] — fix: Steam user module errors
• [#519] — fix: BentBox username module errors
• [#520] — fix: resolve BDSM Singles browser challenge
• [#521] — fix(user_scan): restore 11 modules that could never return a verdict
• [#522] — fix: batch execution for multi-module scan progress bar
• [#523] — fix(bentbox): detect profiles via the ProfilePage JSON-LD
• [#524] — fix: unblock apexlegends, buzzfeed, cups7 and flickr
• [#525] — chore: retire Motherless modules to abandoned/ (site is offline)
• [#528] — feat(core): add impersonate_request_async for the email modules
• [#529] — fix(wordpress): treat email_login_not_allowed as a registered account
• [#530] — fix(deezer): key the verdict on the email constraint alone
• [#531] — fix(nytimes): recognise show-welcome-back as a registered account
• [#532] — fix(nextdoor): name the geo null-route instead of a raw resolver error
• [#533] — fix(kick): route the signup check through the impersonating transport
• [#534] — fix(fapfolder): route the signup check through the impersonating transport
• [#535] — fix(patreon): clear the 403 and recognise the sso_required auth step
• [#536] — fix(letterboxd): clear the challenge that served HTML where JSON was expected
• [#537] — fix(classmates): clear the WAF 403 on the login handshake
• [#538] — fix(walmart): clear the 412 session mismatch
• [#539] — fix(pornhub): probe a sub-addressed alias to get a verdict again
• [#540] — fix(github): find accounts via the search API when signup is challenged
• [#541] — fix(spankbang): impersonate Safari to clear the Cloudflare challenge
• [#542] — fix(facebook): follow canonical-casing redirects and match both miss wordings
• [#543] — fix(livejournal): resolve journals, and split purged from suspended
• [#544] — fix(defensivecarry): confirm a miss instead of inferring it from a bare 200
• [#545] — fix(thefirearmsforum): confirm a miss instead of inferring it from a bare 200
• [#546] — fix(producthunt): confirm a hit on the profile title instead of a bare 200
• [#547] — fix(annaabi): name the Cloudflare challenge instead of emitting a bare 403
• [#548] — fix(donatello): confirm a creator page instead of returning taken on any 200
• [#549] — fix(yaga): name the CloudFront country block instead of a bare 403
• [#550] — fix(advfn): clear the Cloudflare wall blocking every lookup
• [#551] — fix(babepedia): clear the Cloudflare wall blocking every lookup
• [#552] — fix(bdsmlr): resolve blogs through the site API
• [#553] — fix(medium): match the served handle and follow subdomain redirects
• [#554] — fix(stackoverflow): verify the fragment before returning a verdict
• [#555] — fix(riot-id): require a boolean verdict from the lookup API
• [#556] — fix(bdsmsingles): stop reporting every handle as free
• [#557] — fix(annaabi): name the Cloudflare challenge instead of emitting a bare 403 (followup)
• [#558] — fix(chess_com): resolve mixed-case handles instead of erroring on the 301
• [#559] — feat(cross-scan): pivot a finished scan into username and email scans, and rate each hit
• [#560] — feature: Tinder username module
• [#563] — fix(reddit): stop naming a boolean flag after an email field
• [#564] — fix(gitlab): publish the account's public email
• [#565] — feat(devto): extract the linked github and twitter handles
• [#566] — feat(liberapay): extract the OAuth-verified accounts the profile vouches for
• [#567] — feat(ifttt): extract the profile instead of discarding the response
• [#568] — feat(flickr): extract the profile's linked social accounts
• [#569] — fix(monkeytype): stop reporting real accounts as errors, and extract the profile
• [#570] — docs: sync README with main features and refine layout
• [#571] — fix: resolve core engine concurrency hangs
• [#572] — feature: Andele Mandele username module
• [#573] — feat(email_scan): add asafeer, tatacliq, couplejoy, lovenudge modules

Credits

Thanks to all contributors and reviewers for this batch of changes: @brunolm, @kaifcodec, @kristoisberg, @VamatoHD, @json-hunter07, @A-S-Manoj, @beranka, @w3lld1, and others.