Self-OSINT (the self-dox audit)

Running the reconnaissance toolkit against yourself, deliberately, to find out what an investigator would find. The subject and the analyst are the same person, which is what removes the ethical charge from techniques that are otherwise the spoke's central problem: the capability is identical, the target consented by definition, and the output is a work list rather than a dossier.

The spoke had been circling this for months without a page for it. myip runs ip-reconnaissance inward. cover-your-tracks and nothing-private run browser-fingerprinting inward. cloakquest3r's honest use is against your own domain. Every one of those is a single channel measured by a tool. self-dox-exercise is the first source that treats the whole thing as one exercise with a start, an end, and a score.

The move that makes it work is aggregation, in reverse

osint's ethics section says the harm concentrates in aggregation — public fragments are individually harmless and jointly identifying. A self-audit only tells you anything if it performs that same aggregation on you. Checking your EXIF alone, or your broker listings alone, measures a channel and misses the chain, and the chain is what the exercise is built to expose: handle → forgotten account → real first name → city → broker file → address, with each link cheap and none of them secret.

That is also why the audit cannot be a tool. Each hop needs a judgment about which weak result to carry forward, which is the step ai-osint documents LLMs absorbing on the offensive side and which nothing on the defensive side has automated.

What it can and cannot establish

It measures exposure, not risk. A finding says a path exists, not that anyone has walked it. The one probe in self-dox-exercise that reaches for the second question — reading a data-broker record's "last updated" timestamp as evidence someone recently pulled your file — is an inference from a field the brokers do not document.

A clean result decays. The recommendation to repeat every 90 days is an admission that this is a snapshot of a surface that other parties keep changing: brokers re-aggregate, platforms alter what they strip, old accounts get bought. The audit has no persistence and no alerting; it is a point measurement of something continuous.

Your threat model includes other people. Search your own address on a broker and the roommates, partners and family listed at it come back too. Their exposure is yours and yours is theirs, and neither party can remediate alone — the one part of the exercise where an individual's fixes provably do not close the gap.

Remediation has an order, and the order is the finding

The prescriptions themselves are not novel (per-context handles, EXIF stripping, blank backgrounds, delayed posting). What self-dox-exercise adds is that they are dependency-ordered: kill linkability before scrubbing content, because scrubbing a post that is already correlated to four other identities buys nothing. username-reconnaissance's defensive read reached the same conclusion from the offensive side and named the reason it rarely happens — a decade-old handle is also a reputation, so the cheapest fix is the one people won't make.

Two second-order rules go further than the standard advice:

• Remediation is observable. Mass deletion after you notice you are being watched tells the watcher you noticed.
• The goal is cost, not silence. "Leak boring, conflicting, useless data" concedes that a person who posts will always leak, and moves the target from zero exposure to expensive correlation.

Related

osint · self-dox-exercise · data-broker · myip · cover-your-tracks · nothing-private · browser-fingerprinting · ip-reconnaissance · username-reconnaissance · geolocation-chronolocation · mysterium-node · synthesis