Skip to content

Project Status

Last updated: 2026-07-26.

Current release: v1.0.5 — stable, actively maintained, low-churn by design.

Health

Signal State
CI (build, vet, gofmt, race-enabled tests) CI
Container image publish Docker
CodeQL static analysis CodeQL
API docs pkg.go.dev (auto-generated from source)
Vulnerability scanning govulncheck on every push/PR; Dependabot monthly, grouped per ecosystem
Secret scanning gitleaks over full git history on every push/PR

What works today

All four delivery forms are functional and released:

  • Go library — full client with functional options, typed errors, context support.
  • CLI — breaches, breach, account, pastes, dataclasses, password, serve.
  • HTTP JSON API — 7 routes, published as a multi-arch (amd64/arm64) image on GHCR.
  • FrankenPHP extension — hibp_pwned_password_count() and hibp_breaches() as native PHP functions.

HIBP API v3 endpoint coverage

HIBP endpoint Library method Status
range/{first5HashChars} (Pwned Passwords) PwnedPasswordCount ✅
breaches GetBreaches ✅
breach/{name} GetBreachedSite ✅
dataclasses GetDataClasses ✅
breachedaccount/{account} GetBreachedAccount ✅
pasteaccount/{account} GetPastedAccount ✅
latestbreach — not yet (Roadmap)
subscription/status — not yet (Roadmap)
breacheddomain/{domain} (domain search) — not yet (Roadmap)
Stealer-log endpoints — not yet (Roadmap)
NTLM mode for Pwned Passwords — not yet (Roadmap)

The Breach model includes the newer flags IsMalware, IsStealerLog, and IsSubscriptionFree.

Maintenance model

This project is deliberately low-maintenance:

  • Scans and builds run on push/PR only, so badges cannot go red while the repo is idle.
  • Dependabot runs monthly with grouped PRs (one per ecosystem).
  • Container images are published only on v* tags or a manual workflow run — never on regular pushes.
  • Published Go module versions are immutable (Go module proxy); any fix ships as a new patch tag.

See Releases and Versioning for the release procedure and Roadmap for what's next.