user-scanner

Do not insert raw user-controlled values directly into an f-string URL. Percent-encode each query value with urllib.parse.quote:

from urllib.parse import quote

url = f"{base_url}{endpoint}?{param}={quote(target, safe='')}"
api_url = f"https://www.instagram.com/api/v1/users/web_profile_info/?username={quote(user, safe='')}"

For multiple parameters, prefer urlencode:

from urllib.parse import urlencode

params = {"username": user, "email": email}
url = f"{base_url}{endpoint}?{urlencode(params)}"

Audit all f-string query URLs, including modules under core/, email_scan/, and user_scan/, and encode every interpolated user, username, email, target, or similar value. Encode only the parameter values, not the full URL. Add regression tests using inputs containing &, #, %, +, whitespace, and non-ASCII characters. The existing leetcode.py usage of urllib.parse.quote() can be used as the reference pattern.

Setting concurrency to 0 creates asyncio.Semaphore(0), so every module waits forever before the per-module timeout starts. In MCP mode, this can also hold the scan lock and block the queue. As a workaround on affected versions (including 1.5.2.1), run scans with a positive concurrency value, such as -C 1, or set MAX_CONCURRENT_REQUESTS=1; do not use 0 or negative values. The fix adds validation in CLI/MCP boundaries and both orchestrator.set_concurrency and email_orchestrator.set_concurrency to raise ValueError for values below 1, with minimum: 1 in the MCP schema. Upgrade to a release containing the fix for early, consistent validation for username and email scans.

This is fixed in PR #692. In version 1.5.2.1 (commit 780d077a468035c6afd6b4a0f987317db651528b), pdf_generator.fetch_and_resize_image() calls httpx.get() directly. With httpx 0.28.1, that creates a client with proxy=None, so the configured proxy from get_proxy()/set_proxy_manager() is not used and PDF image requests can reveal the operator's IP.

Upgrade to a release containing PR #692, or apply that patch from source:

git fetch origin pull/692/head:pr-692
git checkout pr-692
python -m pip install -e ".[pdf]"

The patch routes PDF media downloads through get_proxy(), honors get_global_timeout(), and does not silently fall back to a direct connection when the proxy fails. Verify the fix by setting an unreachable proxy such as http://127.0.0.1:1: the media download should fail or be skipped, and the destination server must receive no direct request. If maintaining a fork, replace the direct httpx.get() call in user_scanner/core/pdf_generator.py with the scanner's shared proxied request helper or an explicit client using get_proxy() and get_global_timeout().

This affects user-scanner 1.5.2.1 at commit 780d077a468035c6afd6b4a0f987317db651528b. The _warmed cache is keyed only by (impersonate, proxy), so a successful warmup for one origin marks the shared session as warmed for every other origin, even though clearance cookies are site-specific.

Fix by upgrading to a main-branch version containing PR #680, merged two commits after the affected commit:

python -m pip install -U git+https://github.com/kaifcodec/user-scanner.git@main

If working from a checkout:

git pull origin main
python -m pip install -e .

If you cannot upgrade, cherry-pick/merge PR #680. The correction must scope warmup state by the session/browser plus warmup_url or origin-specific clearance context, not by browser/proxy alone. A failed warmup must remain retryable without clearing other sites' state. As a temporary workaround, run each origin in a separate process so the shared _warmed set is not reused across sites.

Verify by requesting two different origins with the same browser and no proxy: each origin should send its own warmup request once before its normal request, repeated requests should reuse the warmed state, and concurrent/failed warmups should be handled safely.

In v1.5.1, screener.in changed its error markup from <ul class="errorlist"> to <ul class="errorlist" id="id_password_error">, so the exact-string check in email_scan/other/screener.py fails. Replace the marker check around line 68 with a regex that tolerates additional attributes:

import re

_REQUIRED = re.compile(r'<ul class="errorlist"[^>]*>\s*<li>This field is required\.</li>')

if _REQUIRED.search(res_text):
    return Result.available(url=show_url)

The previous check was:

if '<ul class="errorlist"><li>This field is required.</li>' in res_text:
    return Result.available(url=show_url)

After patching the installed package file, rerun:

user-scanner -e john.smith.4471@gmail.com -m screener --all

The taken branch is likely unaffected because it matches the plain text User account with this Email already exists. If maintaining the module, also use separate error messages for missing CSRF/token and unclassifiable POST responses to make future markup changes easier to diagnose.