Light mode uses the same typeface as dark, and small text is easier to read in both.

• Light theme fell back to the browser font. --font-ui, --font-mono and the corner radii were defined only on the dark token block. With html.ap-theme-light set, font-family: var(--font-ui) was invalid, so the workbench, popup, pivot and palette rendered in the system sans instead of IBM Plex. Those tokens now live on a shared block both themes use.
• Antialiased glyphs on white. Light inherited -webkit-font-smoothing: antialiased from the dark surface, which thins strokes on a light background. Light now uses the browser default; dark keeps antialiased.
• Secondary text and type colours. Muted, dim and faint labels were only just over AA at 9–12px (about 5:1). Both palettes step those tokens up to roughly 6–9:1. Light accent, verdict and IoC type colours are a shade darker so pills and links hold up on white.

No change to permissions or the local-only model.


./scripts/package.sh
# → aperture-osint-v4.2.2.zip


A light theme, and a playbook editor you can actually edit playbooks in.

• Light theme — Settings → Appearance offers System, Dark and Light. It applies to the workbench, the popup, and the pivot and palette drawn on pages. Both token sets are checked against WCAG AA: every text-on-surface pair in the theme is at least 4.5:1.
• Page highlights follow the page, not the theme — a highlight sits in the site's own content, so it now picks its colour from the page's background rather than from your Aperture theme. On a white page the indicator colours were 2.2–3:1 before; they are 5.3–7.7:1 now.
• The workbench keeps up with your pivots — an indicator you run from the on-page pivot, the context menu or the palette in another window now appears in the inbox on its own, no reload. The refresh holds off while you are typing or have a dialog open, and waits until you come back to the tab, so the list never moves under you. Scroll position and an open pivot card survive it.
• Ordered service editor for playbooks — the multi-select is replaced by a numbered list with move and remove controls, plus an add menu grouped into the usual pivots for the trigger type and all other services. The list is the run order, so reordering is now possible at all.

One indicator card, rendered in two hosts. The pivot, the popup detect block and the inbox row all answered the same question — what is this indicator and what do I do with it — from their own markup, section order and control sizes. They are now one definition in extension/indicator-card.js.

• Anchored pivot popovers — on-page and workbench pivots are 320px popovers anchored to the token, with a caret, focus trap, and dismissal on Escape, outside click or the anchor scrolling away. The full-height drawer and both scrims are gone.
• Navigation band for links — a highlighted token inside an <a> captures its real href, so the card can open the destination in a background tab (http(s) only) and flags where the link text and the href disagree.
• Popup is a launcher — open the workbench, plus the two settings only the current tab can answer for: on-page detect on/off and disable this site. Detect field, quick tools, playbook list, recent and the services/domain lists move out.
• Workbench Settings screen — enabled services, the global on-page detect default and disabled-domain rules now live in one place instead of the popup. Labs stays experimental-only.
• Playbook defaults per IoC type — assign the playbook each type should run by default, from the Playbooks screen or the edit modal. Consumed by the pivot's primary action, the context menu's Run default playbook, and ⌘K.
• ⌘K is indicator-first — paste an indicator and the default playbook for its type is the first, pinned result; Enter runs it. No follow-up prompt().
• Workbench overview — a single metrics rail replaces the metric blocks, one filter bar with a Tags menu replaces the scattered filters, and the reworked row anatomy anchors the pivot to the row you clicked.

• Disabled domains — exclude hosts from on-page IoC detect and the page palette (popup Settings → Disabled domains). Suffix match: crowdstrike.com covers falcon.crowdstrike.com; use Disable on this site for the active tab. Synced via storage.sync.disabledDomains. Separate from case-session capture excludes.

• Workbench / pivot UI — shared pivot card layout polish on dashboard and on-page surfaces
• Branding — extension icon in popup header; store listing assets/checklist updates

./scripts/package.sh
# → aperture-osint-v4.1.0.zip


Local-first OSINT workbench expansion across the P0–P4 product roadmap.

• P0 Polish — case/history hygiene, playbook edit, bulk playbooks with throttle, tags + search, clipboard packs, public pivots (crt.sh, RDAP, URLhaus, ThreatFox, Wayback, NVD, BGP HE), keyboard commands
• P1 Console — session capture, investigation side panel page, related IoCs on pivot, playbook delay/concurrency/skip-private, case templates + sources
• P2 Sense-making — detection wave 1 (ETH, ATT&CK, JA3/JARM labels, paths, onion, Telegram/Discord), relationship graph, offline packs, type/favorites widgets
• P3 Platform — IndexedDB helper, feature-flagged opt-in API/LLM/workspace export, Labs screen
• P4 Frontier (flagged) — email header parser, page IoC diff, confidence hints, DevTools panel, Sigma assist, local Ollama hook

Defaults unchanged: no API keys, no telemetry, overlay off by default. Labs flags are opt-in.


Reload the unpacked extension (Chrome/Firefox). Open the dashboard for Graph, Offline packs, and Labs.

Release Notes — Aperture v3.1.1

What's new

Delete playbooks from the dashboard (✕ on each card) — removes them from storage and the right-click menu

Always refang before opening OSINT tabs — right-click or search on defanged text like 8.8.8[.]8 / hxxp://… sends the clean IoC to AbuseIPDB and other tools

Package

./package-for-firefox.sh

Major release: rebrand to Aperture — OSINT Workbench, Manifest V3, full UI overhaul from the design handoff, and Bugbot fixes.

• Aperture UI — IBM Plex design system, popup launcher, full dashboard workbench
• Manifest V3 — service worker background, action popup, MV3 host permissions
• Playbooks — replace custom combinations; import/export share codes (APX|…)
• Cases — local investigation grouping with timeline and exportable JSON reports
• Bulk extract — refang + classify IoCs locally (IP, domain, URL, hash, email, CVE, BTC, ASN)
• ⌘K palette — tools, playbooks, navigation, recent indicators
• On-page pivot card — enrichment, verdicts, tools, playbook run, add-to-case
• Storage — history/cases in storage.local; settings/playbooks in storage.sync; auto-migration from 2.3.0

• Overlay toggle race: async storage.sync.get no longer overwrites a newer onChanged value
• URL IoC matches strip trailing punctuation / unmatched closers
• getOverlayConfig error path returns in-memory enabledServices defaults (not {})
• searchService returns { success: false } for unknown service names

Name: Aperture — OSINT Workbench

Short description:
Local OSINT workbench for SOC analysts — IoC pivot, playbooks, cases. No API keys. Formerly SOC OSINT Search.

Detailed description (keyword-aware):
Aperture is an OSINT browser extension for security operations and threat intelligence workflows. Select an indicator of compromise (IP, domain, hash, URL, email, CVE) and open public tools such as VirusTotal, AbuseIPDB, Shodan, URLScan, Censys, AlienVault OTX, GreyNoise, and more.

Everything runs locally. There are no accounts and no API keys. Optional on-page detection highlights IoCs in the page you’re viewing; clicking opens a pivot card for verdicts and tool launches. Use playbooks to open a sequenced set of OSINT tabs in one click, and cases to keep related indicators together.

Formerly published as SOC OSINT Search.

Privacy / permissions:
- storage — settings, playbooks, local history and cases
- contextMenus, tabs, activeTab — right-click search and opening OSINT sites
- Host access — optional page highlights and selection workflows; no remote code; no telemetry

1. Fresh MV3 load (Chrome + Firefox): popup, dashboard, context menu
2. Upgrade from 2.3.0 profile: history migrated to local; combinations → playbooks
3. Overlay toggle spam: enable/disable quickly — highlights match final state
4. URL like https://evil.example/path). — match without trailing ).
5. Unknown searchService name → failure response
6. Bulk extract → add to case → run playbook → export report
7. ⌘K / Ctrl-K on popup and dashboard

./package-for-firefox.sh
# → aperture-osint-v3.0.0.zip


Critical Bug Fix: Archive Storage Management

Fixed issue where archive would stop updating after reaching storage quota limit.

Changes:

• Implemented automatic storage rotation when quota reached
• Removed hard-coded 100 entry limit
• Added storage diagnostics tool (check-storage.html)
• Enhanced error handling for quota errors
• Archive now dynamically adapts to available storage space

No new permissions required. Fully backwards compatible.

Bug Fix Release

What's Fixed:

• FIXED: Re-analyze button for custom combinations - The "Run" button in the popup history and "Re-analyze" button in the archive page now properly work with custom combinations
• Previously, clicking re-analyze on an IoC that was searched using a custom combination (e.g., "IP Investigator") would fail silently
• Now correctly opens all tools that are part of the custom combination

Technical Changes:

• Updated rerunAnalysis() function in both popup.js and archive.js
• Added custom combination lookup from storage when tool name doesn't match a standard service
• Maintains cross-browser compatibility (Chrome callbacks + Firefox promises)

Major UI/UX Overhaul + New Service

What's New:

• NEW: Spur.us Integration - Added Spur.us as a new OSINT service for IP reputation analysis
• NEW: Manage Services Modal - Introduced a cleaner, modal-based service management interface
• NEW: Active Tools Display - Popup now shows only enabled services as compact badges
• NEW: Smart Updates - New services automatically enabled when you update the extension (preserves your existing preferences)

UI Improvements:

• Extension icon now appears in popup and archive page headers
• Significantly cleaner popup interface with optimized spacing
• Compact, properly-sized toggle switches
• Entire service rows are now clickable for easier toggling
• Uniform button sizing across all modals for consistency
• Grid-based layout for better space utilization
• Enhanced visual polish with improved hover effects

Bug Fixes:

• Fixed toggle switch sizing and vertical alignment
• Resolved spacing issues in service management modal
• Improved responsive layout for better display

Version 2.0.0 - Major Update

🚀 NEW FEATURES

Custom Combinations
• Create custom multi-tool searches for one-click analysis
• Combine 2 or more OSINT tools into shortcuts (e.g., "IP Investigator")
• Appears at the top of context menu with ⚡ lightning bolt icon
• All selected tools open simultaneously in separate tabs
• Perfect for SOC analysts with favorite tool combinations

Full History Tracking
• Track all analyzed IoCs with timestamps
• Recent Analysis section shows last 5 searches in popup
• Quick re-analyze button for any previous search
• History persists across browser sessions (up to 100 entries)

Beautiful Archive Page
• View all historical searches with professional statistics dashboard
• Filter by IoC type (IP, Domain, Hash, URL, Other)
• Statistics show total analyses, most used tools, and common IoC types
• Re-analyze any historical IoC with one click
• Clear history functionality with confirmation

Smart IoC Detection
• Automatic detection of IPv4 addresses
• IPv6 address support
• MD5, SHA1, and SHA256 hash recognition
• Domain name detection
• URL detection

🎨 DESIGN IMPROVEMENTS

Modern Cyber UI
• Complete redesign with dark cyber aesthetic
• Gradient accents (blue to purple theme)
• Smooth animations and transitions
• Glassmorphism design with backdrop blur
• Animated grid background in archive page

Enhanced Popup
• Improved scrolling and layout
• Custom styled scrollbars
• Better visual hierarchy
• Purple-themed combinations section
• Responsive design for different screen sizes

Professional Archive
• Statistics cards with hover effects
• Interactive filter buttons
• Professional table with color-coded IoC type badges
• Smooth hover animations
• Empty state messages

🔧 TECHNICAL IMPROVEMENTS

Unified Codebase
• Single extension works on both Chrome and Firefox
• Removed separate chrome/firefox directories
• Cross-browser API compatibility layer
• Better code maintainability

Security & Compliance
• CSP compliant - all JavaScript moved to external files
• No inline scripts or event handlers
• Proper event listener attachment
• Fixed all Content Security Policy violations

Enhanced User Experience
• Custom styled confirmation modals (no more browser dialogs)
• Improved error handling and logging
• Better storage management
• Context menus update automatically when settings change

💪 FOR SOC ANALYSTS

• Create workflows with custom tool combinations
• Track all investigations in one place
• Quick re-analysis of previous IoCs
• Filter history by IoC type for case management
• Professional interface suitable for SOC environments

📊 STATISTICS

• 2,935+ lines of new code added
• 22 files changed in this major update
• Modern tech stack with latest best practices