disclo

Domain contact finder. Give it a domain, get every email, handle, and lead associated with it - across 12 passive sources, in parallel.

$ python disclo.py gitlab.com

disclo -> gitlab.com
----------------------------------------------------------------------

  [hackerone]
    https://hackerone.com/gitlab  (url)  <- Direct H1 handle match

  [nvd_cve]
    [email protected]  (email)  <- CVE sourceIdentifier (CVE-2021-22262)

  [security.txt]
    https://hackerone.com/gitlab/  (url)
    https://about.gitlab.com/security/disclosure/  (url)

  [twitter]
    https://twitter.com/gitlab  (twitter)  <- GitLab - Build software faster...

  Total: 30 contacts found

---

Install

git clone https://github.com/Chaelsoo/disclo
cd disclo
pip install -r requirements.txt

---

Usage

python disclo.py <domain>

Examples:

python disclo.py example.com
python disclo.py tawk.to
python disclo.py speakylink.com

---

Sources

Source	What it finds
security.txt	Contact emails and URLs
security_page	Emails from /security, /contact, /about pages
dns_dmarc	Emails from DMARC rua/ruf records
crtsh	Emails embedded in certificate CN/issuer fields
hackerone	H1 and Bugcrowd program pages
github	Org member emails, SECURITY.md links
npm / pypi	Package maintainer emails
job_posting	Job URLs on Lever and Greenhouse
nvd_cve	CVE sourceIdentifier emails, H1/Bugcrowd references
twitter	Handles via syndication API (no auth)
sitecrawl	Emails and author names from sitemap-driven crawl
appstore	App Store developer info matched by bundle ID

---

Optional env vars

Read automatically, no flags needed.

Variable	Effect
GITHUB_TOKEN	Increases GitHub API rate limits (5000 req/hr vs 60)
LINKEDIN_USER + LINKEDIN_PASS	Enables LinkedIn contact enrichment via session API
TWITTER_BEARER_TOKEN	Enables Twitter v2 API search

export GITHUB_TOKEN=ghp_xxxxxxxxxxxx
python disclo.py target.com

---

Output types

• email - email address
• url - platform or advisory link
• twitter - Twitter/X handle
• linkedin - LinkedIn profile
• github - GitHub profile
• other - person's name

---

Project structure

disclo/
├── disclo.py
├── requirements.txt
├── disclo/
│   ├── core/
│   │   ├── runner.py      # async orchestrator
│   │   ├── store.py       # contact deduplication
│   │   └── utils.py       # email validation
│   ├── sources/           # one file per data source
│   │   ├── security_txt.py
│   │   ├── security_page.py
│   │   ├── dns_records.py
│   │   ├── crtsh.py
│   │   ├── hackerone.py
│   │   ├── github.py
│   │   ├── npm.py
│   │   ├── jobs.py
│   │   ├── nvd.py
│   │   ├── twitter.py
│   │   ├── sitecrawl.py
│   │   └── appstore.py
│   └── output/
│       └── printer.py

Adding a new source: create disclo/sources/mysource.py with an async def run(client, domain, store) function, then import and add it to disclo/core/runner.py.