# Phase 15: OSINT Forums, Collaboration Tools & Log Aggregators - Context

**Gathered:** 2026-04-06
**Status:** Ready for planning
**Mode:** Auto-generated

<domain>
## Phase Boundary
Adds ReconSource implementations for developer forums (Stack Overflow, Reddit, Hacker News), collaboration platforms (Discord, Slack, Trello, Notion, Confluence), and log/monitoring aggregators (Elasticsearch, Grafana, Sentry, Kibana, Splunk) to detect API keys shared in public discussions, workspace leaks, and exposed logging dashboards.
</domain>

<decisions>
## Implementation Decisions
### Claude's Discretion
All implementation choices are at Claude's discretion. Follow the established Phase 10 pattern: each source implements recon.ReconSource, uses pkg/recon/sources/httpclient.go for HTTP, uses httptest for tests. Each source goes in its own file.
</decisions>

<code_context>
## Existing Code Insights
### Reusable Assets
- pkg/recon/sources/ — established source implementation pattern from Phase 10
- pkg/recon/sources/httpclient.go — shared retry HTTP client
- pkg/recon/sources/register.go — RegisterAll (extend per phase)
- pkg/recon/source.go — ReconSource interface
</code_context>

<specifics>
## Specific Ideas
- StackOverflowSource — search Stack Overflow posts/answers for leaked keys
- RedditSource — search Reddit posts/comments for key exposure
- HackerNewsSource — search Hacker News submissions/comments for keys
- DiscordSource — search public Discord servers/channels for leaked keys
- SlackSource — search publicly indexed Slack messages for keys
- TrelloSource — search public Trello boards for exposed credentials
- NotionSource — search publicly shared Notion pages for keys
- ConfluenceSource — search publicly accessible Confluence wikis for keys
- ElasticsearchSource — search exposed Elasticsearch instances for key data
- GrafanaSource — search publicly accessible Grafana dashboards for keys
- SentrySource — search exposed Sentry instances for leaked keys in error reports
- KibanaSource — search publicly accessible Kibana dashboards for key data
- SplunkSource — search exposed Splunk instances for key leaks in logs
</specifics>

<deferred>
## Deferred Ideas
None — straightforward source implementations.
</deferred>
