v1.5.0

# user-scanner v1.5.0 — 2026-08-13

This release collects merged changes since v1.4.3.1. It focuses on reliability and accuracy fixes across many modules, profile enrichment improvements, and a major cross-scan workflow that lets you pivot finished scans into focused username and email scans and score each hit.

## Notable changes

### Cross-scan workflow
- feat(cross-scan): pivot finished scans into username and email scans, and rate each hit (#559) — by @brunolm; reviewed by the team.
  - New "cross-scan" flow: after a scan finishes, you can run a targeted pivot that splits results into username and email scan tasks, re-checks hits with specialized modules, and assigns a confidence rating to each discovered item.
  - Helps prioritise follow-ups and reduces manual triage by surfacing higher-confidence matches first.
  - CLI and docs updated with usage and interpretation guidance for cross-scan results.

### Features & enhancements
- feat: add Tinder username module (#560) — by @kristoisberg.
- feature: Andele Mandele username module (#572) — by @kristoisberg.
- feat(email_scan): add several new email modules (multiple PRs, incl. #508, #495, #573) — by @kaifcodec and contributors.
- feat(core): add `impersonate_request_async` to make email modules non-blocking and improve throughput (#528).
- feat(pdf): parallelize profile photo downloading with a progress bar for faster PDF reports (#506).
- feat(gravatar): further enrich profile extraction (links, interests, profile details) (#516).

### Bug fixes & accuracy improvements
- fix: resolve core engine concurrency hangs (#571) — avoids scan stalls under heavy parallel load.
- Wide-ranging module fixes that improve verdict accuracy and clear challenges/WAF/Captcha for lookups (GitHub, Facebook, Medium, Patreon, etc.). These reduce false positives and restore modules previously unable to return verdicts.
- fix(cli): prevent bandwidth waste on invalid output formats (#502).
- fix(core): display and export the `media` dictionary in console, JSON, and CSV outputs so avatar/media URLs are preserved (#517).
- Numerous small but important fixes to restore and harden modules that previously returned spurious results or errors (see detailed PR list).

### Documentation
- chore/docs: add contributor guides and small docs improvements; README sync and layout refinements (#505, #570).
- Updated CLI help and docs to cover cross-scan usage and result rating.

### Tests, CI & maintenance
- Continued test additions and maintenance (flake/nix dependency fixes, refactors separating media from extra, and CI stability tweaks) — examples: #513, #496.
- Housekeeping: retire permanently-offline modules to abandoned/ (#525), various cleanups.

---

## Detailed merged PRs included in v1.5.0 (merged after v1.4.3.1)

- #504 — fix: Steam user module errors
- #519 — fix: BentBox username module errors
- #520 — fix: resolve BDSM Singles browser challenge
- #521 — fix(user_scan): restore 11 modules that could never return a verdict
- #522 — fix: batch execution for multi-module scan progress bar
- #523 — fix(bentbox): detect profiles via the ProfilePage JSON-LD
- #524 — fix: unblock apexlegends, buzzfeed, cups7 and flickr
- #525 — chore: retire Motherless modules to abandoned/ (site is offline)
- #528 — feat(core): add impersonate_request_async for the email modules
- #529 — fix(wordpress): treat email_login_not_allowed as a registered account
- #530 — fix(deezer): key the verdict on the email constraint alone
- #531 — fix(nytimes): recognise show-welcome-back as a registered account
- #532 — fix(nextdoor): name the geo null-route instead of a raw resolver error
- #533 — fix(kick): route the signup check through the impersonating transport
- #534 — fix(fapfolder): route the signup check through the impersonating transport
- #535 — fix(patreon): clear the 403 and recognise the sso_required auth step
- #536 — fix(letterboxd): clear the challenge that served HTML where JSON was expected
- #537 — fix(classmates): clear the WAF 403 on the login handshake
- #538 — fix(walmart): clear the 412 session mismatch
- #539 — fix(pornhub): probe a sub-addressed alias to get a verdict again
- #540 — fix(github): find accounts via the search API when signup is challenged
- #541 — fix(spankbang): impersonate Safari to clear the Cloudflare challenge
- #542 — fix(facebook): follow canonical-casing redirects and match both miss wordings
- #543 — fix(livejournal): resolve journals, and split purged from suspended
- #544 — fix(defensivecarry): confirm a miss instead of inferring it from a bare 200
- #545 — fix(thefirearmsforum): confirm a miss instead of inferring it from a bare 200
- #546 — fix(producthunt): confirm a hit on the profile title instead of a bare 200
- #547 — fix(annaabi): name the Cloudflare challenge instead of emitting a bare 403
- #548 — fix(donatello): confirm a creator page instead of returning taken on any 200
- #549 — fix(yaga): name the CloudFront country block instead of a bare 403
- #550 — fix(advfn): clear the Cloudflare wall blocking every lookup
- #551 — fix(babepedia): clear the Cloudflare wall blocking every lookup
- #552 — fix(bdsmlr): resolve blogs through the site API
- #553 — fix(medium): match the served handle and follow subdomain redirects
- #554 — fix(stackoverflow): verify the fragment before returning a verdict
- #555 — fix(riot-id): require a boolean verdict from the lookup API
- #556 — fix(bdsmsingles): stop reporting every handle as free
- #557 — fix(annaabi): name the Cloudflare challenge instead of emitting a bare 403 (followup)
- #558 — fix(chess_com): resolve mixed-case handles instead of erroring on the 301
- #559 — feat(cross-scan): pivot a finished scan into username and email scans, and rate each hit
- #560 — feature: Tinder username module
- #563 — fix(reddit): stop naming a boolean flag after an email field
- #564 — fix(gitlab): publish the account's public email
- #565 — feat(devto): extract the linked github and twitter handles
- #566 — feat(liberapay): extract the OAuth-verified accounts the profile vouches for
- #567 — feat(ifttt): extract the profile instead of discarding the response
- #568 — feat(flickr): extract the profile's linked social accounts
- #569 — fix(monkeytype): stop reporting real accounts as errors, and extract the profile
- #570 — docs: sync README with main features and refine layout
- #571 — fix: resolve core engine concurrency hangs
- #572 — feature: Andele Mandele username module
- #573 — feat(email_scan): add asafeer, tatacliq, couplejoy, lovenudge modules

---

## Credits
Thanks to all contributors and reviewers for this batch of changes: @brunolm, @kaifcodec, @kristoisberg, @VamatoHD, @json-hunter07, @A-S-Manoj, @beranka, @w3lld1,  and others.