Domain Exposure Watch

Two lanes

| lane | input | needs a key | |---|---|---| | `registeredLookalikes(domain)` | a domain you own | no — public DNS-over-HTTPS | | `breachedOwnedAccount(email, ownedDomains)` | an address on a domain you declared you control | yes, your own key |

The constraint is in the code, not in the terms

An unconstrained "look up any email address" function is a doxxing tool wearing a security jacket. The defensive use — *which of my staff addresses are in breaches, so I can force resets* — only ever needs addresses on domains the operator already controls.

That is also the boundary the breach service itself draws: its bulk surface is gated behind proving you control a domain before it tells you anything about the addresses on it.

So `ownedDomains` is a required argument, not an option with a permissive default:

```ts await breachedOwnedAccount("stranger@gmail.com", ["acme.com"], { apiKey }); // { ok: false, reason: "not_an_owned_domain", detail: "refusing to look up an address // outside the domains you declared you control..." } ```

A refusal is a first-class typed result, not a thrown error someone catches and ignores. It happens *before* the API-key check — so the message is about the address rather than sending you off to get a key you still cannot use — and *before any network call*, which a test enforces with a `fetch` that throws if reached.

There is deliberately no flag to disable it. A switch labelled "allow any address" is the whole tool, and shipping one would make every sentence above decorative.

Ownership falls on a dot. `notacme.com` ends with `acme.com` and belongs to somebody else — a suffix match would hand an attacker lookup on every address at a domain registered specifically to end in yours. A deliberate defect that weakens exactly this is caught by the suite.

"Could not determine" is never reported as "clean"

• `breaches: []` — asked, and the answer was nothing
• `breaches: null` — rate-limited, timed out, or the API errored

Collapsing those two is how an outage becomes a clean bill of health, and it is the single most consequential thing a monitor of this kind gets wrong. The service reports "no breaches" as an HTTP 404, which is easy to mistake for a failure; that mapping is pinned by test in both directions.

The keyless lane

Generates common look-alike variants of your domain — one-character omissions, adjacent transpositions, doublings, homoglyph swaps (`o→0`, `l/i→1`, `e→3`), and the same label on other common TLDs — then DNS-resolves each. A variant that resolves is registered and worth a glance: defensive registration, parking, or someone impersonating you. Bounded to 40 variants so the fan-out cannot run away.

It takes a domain and never a person, which is why this lane needs no constraint at all — every question it asks is a public DNS lookup anyone can make.

Not affiliated

Built to work *with* a public breach-notification API, using your own key, under that service's terms. Not affiliated with or endorsed by it.

Proof

19 tests, 6/6 deliberate defects caught — including the one that matters most: removing the ownership boundary entirely.

Delivery

Source delivered as a private repository invite within 24 hours of purchase. Single-product commercial license: use and modify in any number of products; no redistribution or resale of the source.

Interface

What you call, and what comes back. Types and signatures only — the implementation ships with the source.

  export function addressDomain(email: string): string | null;
  export function isOwnedAddress(email: string, ownedDomains: readonly string[]): boolean;
  export async function breachedOwnedAccount( email: string, ownedDomains: readonly string[], opts: ExposureOptions = {}, ): Promise<BreachLookup>;
  export async function registeredLookalikes( domain: string, opts: ExposureOptions = {}, ): Promise<string[]>;
  export function parseList(raw: string): string[];
  export function typosquatVariants(domain: string): string[];

  export type LookupRefusal = "not_an_owned_domain" | "no_api_key" | "malformed_address";
  export type BreachLookup = | { ok: true;