{"sources":[{"source":"pwnedpasswords","name":"Have I Been Pwned — Pwned Passwords (range API)","kind":"password_exposure","license":"Creative Commons Attribution 4.0","keyless":true,"attribution":"Pwned Passwords by Have I Been Pwned (https://haveibeenpwned.com); k-anonymity range API — plaintext never transmitted."},{"source":"hibp_breaches","name":"Have I Been Pwned — breach catalogue","kind":"breach_metadata","license":"Creative Commons Attribution 4.0","keyless":true,"attribution":"Breach metadata by Have I Been Pwned (https://haveibeenpwned.com); public breaches API, no key required."},{"source":"hibp_breachedaccount","name":"Have I Been Pwned — breached account (keyed)","kind":"account_breach_metadata","license":"Creative Commons Attribution 4.0 (data) + HIBP API subscription (access)","keyless":false,"env_var":"X402_HIBP_API_KEY","attribution":"Breached-account metadata by Have I Been Pwned (https://haveibeenpwned.com); requires an HIBP API key. Metadata only.","configured":false}],"license":"Creative Commons Attribution 4.0 (Have I Been Pwned public APIs)","attribution":"Data from Have I Been Pwned (https://haveibeenpwned.com) — Pwned Passwords (k-anonymity range API) and the public breach catalogue, licensed Creative Commons Attribution 4.0. The privacy-preserving hash check, the metadata normalization and the composite account-takeover scoring are computed by us.","attribution_url":"https://haveibeenpwned.com","privacy_note":"Passwords and full hashes are handled locally and NEVER logged, stored or transmitted — only the 5-hex k-anonymity prefix is sent upstream. Only breach metadata is returned, never leaked plaintext or PII.","ato_signals":{"pw_prevalence_critical":{"weight":40,"dimension":"password","severity":"critical"},"pw_prevalence_high":{"weight":30,"dimension":"password","severity":"high"},"pw_prevalence_medium":{"weight":22,"dimension":"password","severity":"medium"},"pw_prevalence_low":{"weight":12,"dimension":"password","severity":"low"},"domain_stealer_log":{"weight":25,"dimension":"domain","severity":"critical"},"domain_password_breach":{"weight":15,"dimension":"domain","severity":"high"},"domain_sensitive_data":{"weight":15,"dimension":"domain","severity":"high"},"domain_recent_breach":{"weight":12,"dimension":"domain","severity":"medium"},"domain_many_breaches":{"weight":8,"dimension":"domain","severity":"medium"},"domain_some_breaches":{"weight":4,"dimension":"domain","severity":"low"}},"ato_categories":["critical","high","medium","low","minimal"],"disclaimer":"These are automated credential-exposure / account-takeover INDICATORS, NOT a guarantee and NOT a statement that a specific account is currently compromised. A password appearing in a breach corpus means it is unsafe to use; a domain appearing in known breaches does NOT mean any given account on it is breached. No plaintext password, full hash or leaked personal data is stored or returned — only breach metadata and a k-anonymity match."}