PROJECTS

helix(1)
Username OSINT. Give it a name and it asks 11,988 sites whether that account exists: the Sherlock, WhatsMyName and Maigret lists, plus 3,683 Mastodon, Misskey, Lemmy and PeerTube servers. Every account it finds gets checked again on the same site with two usernames that can't exist. If the site says yes to those as well, the hit is thrown away. Whatever survives is graded HIGH, MEDIUM or LOW for how likely it is to be the same person.

pipx install helix-osint
helix-osint -u someone --all

On PyPI, and in review for BlackArch.

git-mistake(1)
For the bad day in git: a detached HEAD, a reset you regret, commits that look gone. You say what went wrong, it finds the way back through the reflog, tells you what it's about to run, and keeps away from anything that would make it worse.

EXAMPLES

Helix on a username nobody has ever used, so any account it reports would be a false positive. This is the real run from 30 October 2026 with Helix 3.6.0.

The fingerprint seals the evidence file, so anyone can check later that the result wasn't edited: helix-osint --verify-evidence.

EXIT STATUS

0 accounts found for the made-up name, across all 11,988 sites.
111 sites said yes to every name and were dropped before they could count.

OPTIONS

--osint
Finding people and accounts from public sources, and proving each finding holds up.

--network
Traffic and protocol analysis, what a host exposes to the world, hardening reviews.

--pentest
Recon, enumeration, exploitation, privilege escalation. Only with written permission and an agreed scope, and everything found goes back to whoever owns the system.

--automate
Jobs that run on a schedule or on an event, are safe to retry, and stay quiet unless something breaks.

NOTES

My tools run on your own machine. No account to make, no telemetry, and no one else's server seeing who you look up.

If a result can't be verified, it doesn't get printed.

If I do something twice, it becomes a script. If I do it every week, it becomes a tool.

BUGS

If Helix shows you an account that isn't real, that's a bug and I want to see it: report a false positive.

SEE ALSO

helix(1), git-mistake(1), Helix OSINT Labs for the write-ups behind the tools.

AUTHOR

Thalha Ahmed. Happy to talk about OSINT tooling, security work, or either project; reach me here on GitHub or through the blog.