Deep scans — actively searching for your credentials across breach databases and platform catalogs — are the most technically interesting feature of a privacy monitor. Here's what's actually involved and where the trade-offs live.
The data problem. Breach data arrives as dumps in every imaginable format: plaintext CSVs, SQL exports, JSON, HTML scrapes. Normalizing it into a queryable catalog is a data-engineering project in itself. The catalog must be continuously updated, since new breaches are published weekly.
Matching techniques. Email matching is straightforward (normalize, lowercase, exact match). Password matching is harder — you don't want to store plaintext passwords, so matching uses hashes. The practical approach is matching on email addresses first, then flagging accounts where the credential data indicates exposure.
The trade-off: breadth vs. privacy. Searching a huge catalog of platforms maximizes findings but requires querying against data you don't control. The ethical design keeps the user's data local and queries in a privacy-preserving way — accepting some loss of coverage in exchange for not shipping your email to every data source.
False positives and negatives. Catalog data is noisy: accounts you deleted still appear, and some breaches are never publicly indexed. A good deep scan reports findings with confidence levels rather than absolute claims.
The honest framing. Deep scans are a discovery tool, not a guarantee. They surface the exposure that's knowable — which is dramatically more than you'd find on your own, but not everything.
Top comments (0)