Crafting the Blueprint: Your Ultimate Swedish-Focused OSINT Tool

Detailed instructions for lovable.dev to build a powerful, ethical, and open-source intelligence gathering platform.

Developing a sophisticated Open Source Intelligence (OSINT) tool requires clear specifications. Below is a comprehensive initial instruction set designed for lovable.dev to build your "Ultimate OSINT Tool," focusing on Swedish data while integrating global resources. This prompt aims to cover all key aspects, minimizing the need for extensive follow-up clarifications.

Key Highlights for Your OSINT Tool

Swedish Data Focus with Global Reach: Prioritizes publicly available Swedish records (company registries, public databases) while integrating global OSINT sources for comprehensive analysis.
Ethical & Legal Framework: Emphasizes strict adherence to GDPR, terms of service of data sources, and legal guidelines for accessing public information only.
Integrated & User-Friendly Design: Leverages Supabase for backend, GitHub for open-source collaboration, free APIs with configurable keys, and aims for an intuitive user interface.

Detailed Prompt for Lovable.dev Development

This section outlines the detailed instructions for the AI or development team at lovable.dev.

Project Title: Ultimate OSINT Tool (Swedish Focus)

1. Objective & Vision

Act as an expert AI developer specializing in OSINT tool creation. Your primary task is to design and outline the code structure for an 'Ultimate OSINT Tool'. This tool must prioritize gathering and analyzing publicly available information related to individuals and entities in Sweden, while seamlessly integrating data from global OSINT resources. The final product must be:

Open-Source: Released under a permissive license (e.g., MIT, Apache 2.0) on GitHub to encourage community contribution.
Legal & Ethical: Strictly adhere to all applicable laws, including GDPR (especially pertinent for Swedish/EU data), and the terms of service of all integrated data sources. Only publicly accessible data should be targeted. No hacking or unauthorized access features.
User-Friendly: Possess an intuitive web-based interface allowing users with varying technical skills to conduct investigations effectively.
Comprehensive: Combine data from diverse sources (public records, social media, web data) to provide a holistic view.

2. Core Features & Functionality

The tool should offer robust capabilities for data collection, analysis, and visualization.

Data Collection Modules:

Swedish Public Data Integration:
- Access and parse data from known Swedish public record sources (e.g., company registries like Bolagsverket access points if available via API, public sections of sites like ratsit.se, mrkoll.se, merinfo.se for publicly listed information – *strictly ensuring compliance with their terms and GDPR*).
- Handle Swedish personal identifiers (like names, potentially publicly listed phone numbers) found in *publicly accessible* databases, respecting privacy regulations. Explicitly avoid illegal access to sensitive data like non-public social security numbers.
Global OSINT Resource Integration:
- Incorporate data sources listed in frameworks like the OSINT Framework (osintframework.com).
- Integrate APIs for global company data, domain information, breach data (e.g., Have I Been Pwned API), etc.
Social Media Intelligence:
- Identify and gather *publicly available* data from major social media platforms (e.g., Twitter/X, LinkedIn, public Facebook info).
- GitHub: Utilize the GitHub API ([GITHUB_API_KEY]) to search public repositories, user profiles, contributions, and potential links based on usernames or emails.
- Instagram: Implement functionality to search for public profiles. For accessing data potentially requiring a logged-in state, explore methods using official APIs (if available and compliant) or require user authentication (OAuth) to ensure access is authorized and respects Instagram's Terms of Service. *Avoid non-compliant scraping.*
- Link social media profiles to individuals, companies, emails, and phone numbers using correlation techniques.
Contact Information Gathering: Extract and potentially validate *publicly listed* phone numbers and email addresses from websites and documents.
Web & Domain Analysis: Include tools for WHOIS lookups, DNS record analysis, website technology identification, and historical web data (e.g., Wayback Machine).

Data Analysis & Correlation:

Entity Resolution: Develop algorithms to identify and merge records likely belonging to the same individual or entity, even with variations in names or identifiers.
Relationship Mapping: Implement features (potentially inspired by tools like Maltego) to visualize connections between different data points (people, companies, websites, social accounts).
Advanced Search & Filtering: Allow users to perform complex searches using multiple criteria (keywords, dates, locations, data types) and filter large datasets efficiently.
Real-time Monitoring (Optional): Consider capabilities for monitoring specific targets (e.g., social media keywords, websites) for changes, adhering to source limitations.

3. Technical Specifications

Backend: Utilize the user-provided Supabase account. Design necessary PostgreSQL tables for storing collected data, user queries, API configurations, etc. Implement Row Level Security (RLS) and appropriate data policies.
Frontend: Develop a clean, responsive web interface using modern frameworks (e.g., React, Vue.js, Svelte). Focus on clear data presentation and ease of navigation.
API Integration:
- Integrate exclusively with free APIs or APIs offering generous free tiers.
- Implement all API keys using placeholders (e.g., `[API_KEY_SERVICE_NAME]`) within the configuration. Provide clear documentation on how users obtain and insert their own keys.
- Use libraries like Python's `requests` or Node.js's `axios` for API calls. Handle rate limits and errors gracefully.
Programming Languages: Suggest Python for backend data processing and API interaction (leveraging libraries like BeautifulSoup for parsing if needed) and JavaScript/TypeScript for the frontend.
Version Control & Hosting: Use the user-provided GitHub account for repository hosting, version control, issue tracking, and potentially GitHub Actions for CI/CD. Consider GitHub Pages for hosting the frontend if suitable.
Security: Implement standard web security practices (input validation, output encoding, secure handling of API keys). Ensure the Supabase setup is secure.
Modularity & Extensibility: Design the tool with a modular architecture, making it easy to add new data sources or features in the future.

4. Legal, Ethical & Compliance Requirements

GDPR Compliance: Paramount. Ensure all data handling, especially concerning individuals in Sweden/EU, complies with GDPR. This includes data minimization, purpose limitation, user rights (access, deletion), and lawful basis for processing (which, for OSINT, is typically legitimate interest applied to *publicly available* data). Provide clear user guidance on ethical use.
Terms of Service Adherence: Strictly follow the ToS for all integrated APIs and websites. Avoid automated querying that could be flagged as abuse.
Transparency: Clearly state the data sources used and the methods employed. Avoid misrepresenting the tool's capabilities or the nature of the data collected.
Disclaimer: Include a clear disclaimer stating the tool uses publicly available information and should be used responsibly and legally.

5. Documentation & Deliverables

Source Code: Well-commented, organized code hosted on GitHub.
README File: Comprehensive instructions for installation, configuration (including setting up Supabase and adding API keys), and usage.
Architecture Overview: A brief document or diagram explaining the tool's architecture.
API Integration Guide: Details on the integrated APIs and how to manage their keys.
(Optional) High-Level Code Outline (JSON): A structured overview of proposed modules/files for backend and frontend.

Minimizing Follow-Up Prompts

This detailed instruction set aims to provide sufficient clarity for lovable.dev to proceed with minimal ambiguity. Key decisions regarding specific Swedish database integrations might require confirmation based on API availability and terms, but the overall framework, features, and constraints are outlined here.

Visualizing the Tool's Structure

This mindmap illustrates the core components and relationships within the proposed Ultimate OSINT Tool, providing a conceptual overview for development.

mindmap root["Ultimate OSINT Tool
(Swedish Focus)"] id1["Core Pillars"] id1_1["Legal & Ethical
(GDPR, ToS)"] id1_2["Open Source
(GitHub, MIT/Apache)"] id1_3["User-Friendly UI"] id1_4["Comprehensive Data"] id2["Data Sources"] id2_1["Swedish Public Data"] id2_1_1["Company Registries"] id2_1_2["Public Records
(ratsit.se, mrkoll.se - *Public sections*)"] id2_2["Global OSINT"] id2_2_1["OSINT Framework"] id2_2_2["Domain/Web Data
(WHOIS, DNS, Wayback)"] id2_2_3["Breach Databases"] id2_3["Social Media (Public)"] id2_3_1["LinkedIn, Twitter/X"] id2_3_2["GitHub (API)"] id2_3_3["Instagram (Public/OAuth)"] id2_4["Contact Info (Public)"] id3["Key Features"] id3_1["Data Collection Modules"] id3_2["Entity Resolution"] id3_3["Relationship Mapping"] id3_4["Advanced Search & Filter"] id3_5["Data Visualization"] id4["Technical Stack"] id4_1["Backend: Supabase (Postgres)"] id4_2["Languages: Python, JS/TS"] id4_3["Frontend: React/Vue/Svelte"] id4_4["Hosting: GitHub / GH Pages"] id4_5["API Management
([API-KEY] Placeholders)"]

Feature Emphasis & Complexity

This chart provides a relative comparison of the importance and potential development complexity for key aspects of the OSINT tool. Higher scores indicate greater significance or challenge. Note: these are subjective estimates for planning purposes.

Potential Free Data Sources & APIs

This table outlines examples of free resources and APIs that could be integrated into the tool. Availability and terms of service must be verified during development. Remember to use placeholders like `[API-KEY]` in the actual implementation.

Resource Type	Example Source/Tool	Focus Area	Notes
Framework	OSINT Framework (osintframework.com)	General OSINT (Links to tools/databases)	Provides a comprehensive directory of resources.
Swedish Public Data	Bolagsverket (Swedish Companies Registration Office)	Swedish Company Info	Check for available public data access points or APIs.
Swedish Public Data	Ratsit.se / Mrkoll.se / Merinfo.se (Public Sections)	Swedish Individual/Company Public Info	Crucial: Use only publicly accessible data respecting ToS & GDPR. Requires careful, compliant implementation.
Code Repositories	GitHub API	User profiles, repositories, code search	Requires API key ([GITHUB_API_KEY]). Rate limits apply.
Social Media (General)	Social Searcher (Free Tier)	Public social media mentions	Check limitations of the free tier.
Breached Data	Have I Been Pwned API	Check emails/domains against known breaches	Requires API key, rate limits apply. Ethical use essential.
Web Archive	Wayback Machine API	Historical website snapshots	Check API terms and limitations.
Domain/IP Info	WHOIS Lookup Tools/APIs	Domain registration data	Many free options available.
Reverse Image Search	TinEye API (Free Tier)	Find sources of an image	Check free search limits.
API Collections	Public-APIs (GitHub Repo)	Various free APIs	Good source for finding relevant free APIs.

Infographic showing icons related to social media tracking tools

Visual representation of tools used in social media analysis, a key component of the OSINT tool.

Leveraging OSINT Tooling Knowledge

Understanding the landscape of existing OSINT tools can inform the development of your custom solution. Many free tools offer specific functionalities that can be either integrated or learned from. This video provides an overview of several free OSINT tools available, showcasing different approaches to data collection and analysis.

The video titled "Top 10 FREE OSINT tools (with demos) for 2024" demonstrates practical applications of various freely accessible tools, covering areas like data scraping, social media analysis, and information gathering. While your tool aims to integrate functionalities, understanding these standalone tools helps define features and potential data sources.

Frequently Asked Questions (FAQ)

Is building and using this tool legal?

The tool itself, if built according to these specifications, is legal as it is designed to access only publicly available information using legitimate means (APIs, public website data) and adheres to GDPR and Terms of Service. However, the *use* of the tool must always be legal and ethical. Users are responsible for ensuring their specific searches and data usage comply with all local laws and regulations, including privacy laws like GDPR, and respect the terms of the data sources. The tool should include disclaimers to this effect.

What specific Swedish databases can be legally accessed?

Access focuses on *publicly available* data. This typically includes information from the Swedish Companies Registration Office (Bolagsverket) that is public, and potentially public sections of commercial directories like Ratsit, Mrkoll, or Merinfo. *Crucially*, any integration must strictly adhere to their Terms of Service and GDPR. Direct scraping or accessing non-public parts of these services is likely prohibited and illegal. Official government APIs for public data should be prioritized if available. Thorough legal review of each specific data source's terms is required during development.

How will the tool handle Instagram data gathering?

Instagram data access is restrictive. The tool should primarily focus on searching for *public* profiles and information. Accessing data that requires a login must be handled carefully:
1. Official API (if available): Prioritize using any official Instagram API, though these are often limited for OSINT purposes.
2. User Authentication (OAuth): Implement an OAuth flow where the *user* logs into their own Instagram account through the tool, granting permission for the tool to perform searches on their behalf. This respects ToS as the user is authenticated.
3. No Unauthorised Scraping: Avoid methods that violate Instagram's Terms of Service, such as automated scraping without authentication or using unofficial APIs, as this can lead to account blocks and legal issues.

What skills should the lovable.dev AI/developer possess?

The ideal developer/AI should have expertise in:
- Backend development (Python preferred, Node.js acceptable)
- Frontend development (React, Vue, or Svelte)
- Database management (PostgreSQL, specifically Supabase)
- API integration (REST APIs, handling authentication, rate limits)
- Web scraping techniques (using libraries like BeautifulSoup, Scrapy - *applied ethically and legally*)
- OSINT principles and tools (understanding data sources and correlation)
- Security best practices
- GDPR and data privacy considerations
- Git and GitHub for version control and collaboration.