One handle, a whole surface

Most people reuse the same handle everywhere. It's convenient—and it's also the first pivot of any OSINT work. From a single handle, we weave a map: where the person posts, what they build, and what they leak without meaning to.

// scope This exercise is done on a CTF target built for it, or on yourself as a self-assessment. OSINT on a real person without consent or a legal framework is harassment: we don't do that.

1. Sweep the handle

We search for the handle's presence across public platforms—code forges, forums, social networks. Each match is a hypothesis to verify, not a certainty: namesakes exist.

2. Correlate, don't collect

The value isn't in the list of accounts, but in the cross-references: the same profile picture, a consistent activity timezone, a writing style, a partial email shown on an old commit.

$ git log --format='%an %ae' | sort -u
 devuser  devuser@personal-domain.tld   # real email in the history

! the classic leak Git commit metadata often keeps a real email address, even if the public profile has since masked it. History doesn't forget on its own.

3. The flag

In this challenge, the chain handle → commit email → public key led to a profile note containing the flag:

flag captured flag{0n3_us3rn4m3_t0_l1nk_th3m_4ll}

Shrink your own footprint

Compartmentalize identities: different handles for different contexts.
Enable the private commit email on forges, and purge the existing history if needed.
Periodically audit what a stranger could assemble from your name—before they do.

OSINT doesn't reveal secrets: it shows how few we actually keep.