Visual Leak Checker

GitHub description: Synthetic-first visible identity leak review for screenshots, PDFs, and shared support artifacts.

Visual Leak Checker is a narrow, synthetic-first tool for reviewing screenshots, PDFs, and shared images for visible identity leaks before they are posted in support tickets, public issues, incident reports, or training decks.

It does not extract text from images yet. The current prototype accepts structured observations from OCR, manual review, or future image pipelines and scores risky visible elements.

Public Review Links

• GitHub URL: https://github.com/dawnportinfo-design/visual-leak-checker
• Portfolio supplement: output/pdf/dawnport-otf-application-supplement.pdf from the portfolio root.
• Publication commands: docs/github-publication-commands.md from the portfolio root.

Review in 3 Minutes

• Value: flags visible identity leaks before screenshots, PDFs, or shared images leave a support workflow.
• Reviewer cue: Review this for artifact-safety workflow, schema design, synthetic fixture coverage, and companion review handoff.
• Safety boundary: accepts structured observations and synthetic fixtures; it does not claim OCR accuracy or automatic anonymization.
• Technical check: run npm run ci to validate clear, review, and block-share scenarios.
• Portfolio contract: from the portfolio root, run npm run visual:report-contract.
• Pass condition: clear, review, and block-share synthetic scenarios pass, and the portfolio report contract check passes.
• Prototype status: prototype-stage, synthetic-only examples, reviewer-ready checks.

Technical Value, Features, and Differentiation

Visual Leak Checker helps reviewers catch visible identity leaks before screenshots, PDFs, or image-based support artifacts are shared. It focuses on what people can accidentally reveal on the screen: handles, phone fragments, device names, browser profiles, notification previews, QR codes, locations, language hints, and other visible clues.

Key functions:

• structured observation format for manual review, OCR output, or future image pipelines
• rule-based severity scoring for visible leak classes
• clear, review, and block-share decisions
• redaction checklist and safe handoff output
• source observation digest for fixture integrity without exposing raw text
• artifact handling boundaries for screenshots, PDFs, tickets, decks, and replacement files

What makes it different is the focus on visible artifact safety rather than hidden metadata. Many teams remember to remove EXIF data but still share screenshots with identifiers visible in the pixels. This tool makes that review explicit and repeatable.

Having this tool reduces accidental harm in support workflows. It gives activists, journalists, and digital safety helpers a simple gate before an image leaves a private context.

Portfolio Verification

This repository is part of the six-tool Dawnport OTF toolkit. From the portfolio root, run npm run readiness before release review, then run npm run verify to check this tool together with account-exit, mirror, phishing-corpus, and DDoS first-hour workflows. Run npm run contracts:artifact from the portfolio root to write artifacts/contract-summary.json, the machine-readable cross-tool contract summary used by portfolio CI.

Also run npm run frontend:capability-map, npm run cli:entrypoints, npm run number:local-first, npm run docs:advisory-safety, and npm run safety:contracts-inventory from the portfolio root before public release or reviewer handoff.

Why This Exists

At-risk users often redact passwords but miss visible account handles, phone fragments, device names, browser profiles, language/region hints, QR codes, map locations, or notification previews. Those leaks are not metadata; they are visible in the artifact.

Current Prototype

• JSON observation format.
• Rule-based risk scoring.
• Redaction checklist output.
• source_observation_digest that pins the reviewed observation file with SHA-256 without exposing raw OCR or contexts.
• Explicit review_scope showing supplied observation count, checked leak classes, and non-claims.
• source_observation_boundary that treats structured observations as artifact derivatives and blocks raw OCR text or exact identifiers from public fixtures.
• Machine-readable share guidance with severity counts and required pre-share actions.
• Human-readable Markdown review output for supporter handoff and issue triage.
• artifact_handling_boundary that blocks forwarding original screenshots, PDFs, or images and records what can be safely shared.
• redacted_replacement_boundary that requires newly redacted replacement artifacts to be rechecked before sharing.
• incident_attachment_boundary that routes DDoS public-update attachments through safe_handoff and downstream publication checks.
• Versioned report schema.
• Synthetic clear, review, and block-share examples.
• CI scenario check across all three decisions.

What This Does Not Do

• does not provide complete identity protection
• does not claim OCR accuracy or automatic anonymization
• does not process real screenshots, PDFs, or images in public fixtures
• does not replace human review before sharing sensitive artifacts

Usage

npm run scan

Generate a reviewer-friendly Markdown handoff:

npm run scan:review

Generate only the minimal safe handoff JSON for a support channel:

npm run scan:handoff

Assert the synthetic fixture contains expected findings:

npm run ci

Structured formats:

• schemas/observation.schema.json
• schemas/report.schema.json

Reports include review_scope, which records the supplied observation count, observed UI kinds, configured visible leak classes, and what the tool explicitly does not check. Reports also include source_observation_digest, a SHA-256 digest over the input observation file bytes, so reviewers can detect observation-file drift without sharing raw OCR text or detailed contexts. Reports also include source_observation_boundary, which treats structured observations as artifact derivatives and requires raw OCR text, exact account identifiers, phone/SMS codes, precise location text, QR payloads, ticket IDs, and session-like strings to be replaced with synthetic summaries before public fixtures or commits. Reports also include share_guidance, which mirrors the top-level decision and explains what must be removed before the artifact can be safely shared. They also include safe_handoff, a smaller report-only summary that omits finding contexts and is intended for support-channel handoff when the original artifact must not be forwarded. Treat block-share as a hard pause until critical visible identifiers are removed. share_guidance also includes handoff_allowed, do_not_share, and a reviewer note so incident tools can share the report without accidentally approving the original artifact. Use --format safe-handoff when a broader channel only needs the decision, severity counts, finding types, excluded detail classes, and minimum safe message without detailed observation contexts. safe_handoff.excluded_detail_classes explicitly states that raw OCR, original artifacts, exact identifiers, and infrastructure details were intentionally omitted. Reports also include artifact_handling_boundary, which keeps original_artifact_share_allowed false, allows only report/safe-handoff summaries and redacted replacement artifacts, blocks detailed finding contexts outside trusted review channels, and repeats non-claims for hidden metadata, OCR accuracy, face recognition, and complete anonymization. redacted_replacement_boundary makes the replacement rule explicit: cropped, blurred, compressed, re-screenshot, or PDF-exported replacements are not treated as safe until visual-leak-checker is re-run, the replacement decision is clear or approved in a trusted channel, and safe_handoff travels with any originally blocked artifact. incident_attachment_boundary connects the report to ddos-first-hour: public-update attachments, incident decks, issue reports, support messages, and mirror-readiness captures should use safe_handoff or rechecked redacted replacements, not original screenshots, DNS panels, provider tickets, traffic graphs, origin IPs, DNS credentials, or command-output screenshots.

Reviewer workflow guidance is in docs/reviewer-guide.md.

Scope

In scope:

• screenshot/PDF review workflows
• visible text and UI-context observations
• identity, location, account, and device leak classes
• sanitized supporter handoff checks
• synthetic DDoS public-update attachment review fixtures

Out of scope:

• automatic OCR accuracy claims
• biometric face recognition
• deanonymization
• malware analysis
• forensic image authenticity

Contributing and Security

Read CONTRIBUTING.md and SECURITY.md before opening issues or pull requests. Public examples must be synthetic and must not include real support artifacts.

OTF Portfolio Role

This project supports number-exit-kit and the mirror tools by reducing accidental identity exposure when people share screenshots during account recovery, mirror incidents, or support sessions.