PRISM: many tools, one place

Why I started

A few years ago I watched a family friend track down scammers by hand. It took him weeks. He jumped between WHOIS lookups, breach databases, username search tools and archived pages, and kept the whole picture in his head.

When I started doing OSINT myself on TryHackMe, I ran into the same thing. Every investigation meant opening a dozen tools, copying results from one into another and losing track of what I had already checked. I wanted one place where I enter a target once and the routine part happens by itself.

What it does

You enter a domain, IP address, email, phone number or username. PRISM picks the modules that fit, 26 in total, from WHOIS, DNS and certificate logs to breach lookups and username search across 3000+ sites, and runs them in parallel.

Progress shows up live, module by module, with an entity graph and a map. At the end you get an exposure score from 0 to 100, an optional AI summary you can ask follow-up questions, and a report in HTML, PDF, CSV or Markdown. 16 of the modules need no API keys, so it works right after install.

How it is built

The backend is Python with FastAPI and asyncio, so slow sources do not block fast ones, and progress reaches the browser over WebSocket. Every data source is one file in the modules folder: adding a source means writing one module, not touching the core. The frontend is Next.js with TypeScript, and the interface is translated into 9 languages.

It ships as a Docker image for amd64 and arm64, so anyone can run it with one command. More than 500 automated tests run with the network mocked, so the suite does not depend on whether some external site is up today.

What was hard

Securing a security tool. A program that sends requests to arbitrary addresses on a user's behalf is easy to abuse, so early on I added authentication, rate limiting, strict CORS and upload limits, and later protected webhooks against SSRF, so a scan result cannot be sent to the server's own internal network.

False positives. Some sites return the same page for any username, so a naive check reports an account that does not exist. Every check has to know what "not found" looks like on each site, and some sites need their API instead of page scraping.

Other people's code. Once outside contributors started sending pull requests, my job changed from writing code to reviewing it: writing issues a newcomer can actually finish, explaining why a change cannot be merged as it is, and keeping releases stable.

Using it responsibly

PRISM only collects what is already public, and the README says plainly what it is for: authorized security assessments, investigating phishing, and checking your own digital footprint. It is not for tracking people who have not agreed to it. The exposure score was built for the last case: a person can see how much of their life is visible from the outside, which brings it back to why I got into security in the first place.