User Scanner
User Scanner Features and Quickstart: Run a Bounded OSINT Check
A source-backed walkthrough of username/email scans, module selection, cross-scan depth, report export, and defensive verification.
What you will learn
- Explain module, pivot, report, and MCP layers
- Run a bounded scan and interpret uncertainty
- Apply authorization, rate-limit, and data-retention controls
Before you start
- Basic Git and command-line usage
- Comfort reading a project README
You can explain the project, run its documented first step, and decide what to verify before adopting it.
Key takeaways
- Begin with an owned/synthetic identity and one module.
- Keep cross-scan depth, concurrency, proxies, and collected fields bounded.
- Treat hits as leads requiring human verification and controlled retention.
Use an owned or synthetic identity
Start with a username or email you control, or a public CTF fixture. Define purpose, authorization, fields to collect, retention, and stop conditions before running the CLI. The README's 465+ vectors make an unconstrained scan easy to over-collect.
Install in a virtual environment, pin the package/repository version, and record the target type, timestamp, modules, proxy policy, and output path in a run card.
Choose one module before a full scan
Use `-m github` or a category flag to validate one module, then expand only when the result is useful. Compare username (`-u`) and email (`-e`) behavior, and export JSON for review before producing a PDF or CSV handoff.
A positive result is a lead, not identity proof. Check response age, profile URL, UID or other metadata, and independently verify before writing a finding.
Add pivots deliberately
`--cross-scan` mines handles, profile links, or public emails and can recurse with `--cross-depth`. Keep depth low, prefer verified links, bound concurrency, and record every pivot edge so a reviewer can see why a secondary target was queried.
Proxy rotation and TLS impersonation may improve reachability but also increase rate-limit and terms-of-service risk. Use only permitted networks and do not bypass access controls.
Review and clean up
Inspect JSON, then generate PDF/CSV only for the fields the investigation needs. Redact or delete unnecessary avatars, bios, follower counts, and exposed addresses; encrypt retained reports and assign a reviewer.
Decision guide
| Criterion | Option A | Option B |
|---|---|---|
| Best when | You need predictable behavior and easy auditing | You need adaptive optimization and have reliable telemetry |
| Main risk | May leave performance on the table | Can become difficult to explain or debug |
Implementation steps
- 1
Install in a pinned virtual environment and define scope.
- 2
Run one username/email module and export JSON.
- 3
Add a low-depth verified cross-scan only when authorized.
- 4
Review, redact, encrypt, and delete outputs according to policy.
Copy-ready example
python3 -m venv .venv
. .venv/bin/activate
pip install user-scanner
user-scanner -u owned-handle -m github -f json -o results.json
user-scanner -u owned-handle --cross-scan --cross-links verified --cross-depth 1Frequently asked questions
Should I run all 465+ vectors immediately?
No. Start with one authorized module and expand only for a documented purpose.
What does cross-scan prove?
It finds candidate pivots from public responses; each edge still needs verification and lawful handling.
Sources
- User Scanner README (captured 2026-08-31)Source checked 2026-08-31
- User Scanner repositorySource checked 2026-08-31