Exovault

A privacy-first exposure intelligence platform for individuals. Exovault checks whether email addresses you've proved you own appear in documented breach and credential-exposure sources, explains what was exposed and how serious it is, and gives you a checklist to fix it. Optionally, it keeps checking and emails you when something changes.

Status: M3 complete (Phase 13 of 13). Everything below exists and is tested. See docs/PROGRESS.md for what was built in each phase and what remains.

Exposure detail and checklist	Mobile	Your data: export and deletion

All screenshots show the fictional demo data the app labels "Demo data".

What it is not

Not a dark-web crawler, not complete coverage, and not a guarantee of safety. Exovault reports only what its configured providers know. "No results" means "not found in the sources we checked", never "you're safe". It only checks addresses whose owners have confirmed them, so it can't be used to look up someone else.

What it does

• Verify, then check:
  • Your account email is verified with a code.
  • Any other address you want checked gets its own ownership code before a single lookup happens.
• Scan with honest progress:
  • Sources are asked in parallel with timeouts, retries and a circuit breaker.
  • Progress streams from persisted state (SSE), never invented steps.
  • Partial failures are shown, and the failed source can be retried.
• Understand the findings:
  • Exposures are normalised and de-duplicated across sources.
  • Each gets a severity based on what was exposed, with a plain-language reason.
  • An Exposure Risk Score (0–100) shows every factor it adds up.
• Fix them: a per-exposure checklist; progress lowers the score, and every change is kept as a snapshot.
• Keep watching:
  • Scheduled monitoring (every 6, 12 or 24 h) runs in a separate worker.
  • Alerts go out only for new or worsened exposures, immediately or as a daily digest, with quiet hours and one-click unsubscribe.
  • A timeline shows every exposure over time.
• Own your data:
  • Download everything as JSON.
  • Delete your account with password re-entry and a 7-day grace period.
  • A resumable purge removes everything and leaves the audit trail unlinked from you.

Architecture

flowchart LR
  B[Browser<br/>server-rendered pages,<br/>small client components] -->|HTTPS · __Host- cookie| P[proxy.ts<br/>CSP nonce · request ID · coarse redirect]
  P --> W[Next.js 16 web<br/>pages · Server Actions · Route Handlers]
  W --> S[server/services<br/>identity · scan · exposure · risk ·<br/>remediation · monitoring · notification · account]
  S --> M[(MongoDB<br/>encrypted identifiers)]
  S --> R[(Redis<br/>rate limits · BullMQ)]
  R --> K[Worker process<br/>scans · monitoring tick ·<br/>alert dispatch · account purge]
  K --> S
  S --> X[Providers<br/>HIBP or demo sources]
  S --> E[Email<br/>SMTP]

• Thin web layer: pages, actions and route handlers authenticate, check ownership in the query, rate-limit and validate. Then they call a service.
• The worker is a separate Node process sharing the same server/ code. It is never run inside a serverless function.
• No transactions: MongoDB runs standalone, so correctness comes from unique indexes, compare-and-set transitions and idempotent upserts.

Details: Architecture, Exposure engine, Database.

This is the beginning of the README. Read the rest at the original. Read the full README ↗