ExposureWatch

Status: MVP deployed; production hardening remains open Audience: Contributors, product stakeholders, and operators
Last updated: 2026-10-02

Purpose

ExposureWatch checks whether an email address appears in known data breaches and presents a simple exposure score, risk level, and breach details.

System At A Glance

• Frontend: SvelteKit 5, TypeScript, Vite, deployed separately from the API.
• Backend: Spring Boot API on Java 21, built with Maven.
• Provider: XposedOrNot public API, called server-side.
• Production frontend: https://exposurewatch.vercel.app
• Production API: https://exposurewatch-api.onrender.com
• Primary workflow: Submit an email, call POST /exposure/check, calculate a score, and render the result.
• Health endpoint: GET /actuator/health.

Documentation

• Product requirements
• Roadmap and backlog
• Architecture
• API contract
• Operations
• Architecture decision records
• Existing API reference (legacy reference; reconcile with the canonical contract before relying on it)

Current Scope

Confirmed

• JSON and form submissions are exposed by the backend endpoint.
• Email values are trimmed and lowercased before the provider lookup.
• The score is capped at 100 and currently assigns 20 points per returned breach.
• The frontend displays loading, error, score, and breach-list states.

Not confirmed

• Automated tests are not present in the inspected source tree.
• Production frontend/API health and the production CORS preflight have been verified.
• Domain ownership, quotas, and provider terms still require operational review.
• Caching and application-level rate limiting are planned but not implemented in the inspected code.