[XB] Content Leak Detection: Fingerprinting & Invisible Watermarks 1.0.1

Investigate leaks of exclusive content from private XenForo communities with invisible fingerprints in content shown to members.

Private forums, paid membership areas, and staff spaces often contain content intended for a limited audience. Each account receives a private, randomly ordered set of invisible Unicode characters. When supported content is displayed to a logged-in member, the add-on inserts characters from that set at a configurable interval. The page looks the same, while copied text can carry a fingerprint. If exclusive content appears outside the community, administrators can paste a sample into the control panel to find possible source accounts and inspect the strength of each match.

---

Features:​

• Leak lookup: Paste a suspected copy of exclusive content into the admin control panel to find accounts whose fingerprints match the recovered character sequence.
• Ranked results: Review the longest matching sequence, its percentage of the characters found in the sample, and the most recently active accounts among equal matches. The page shows up to 100 strongest matches and reports the full result count.
• Partial and cyclic matching: Find a surviving sequence even when the sample starts partway through a fingerprint, wraps around the end of the character set, or contains stray fingerprint characters. Truncated or edited copies can still produce a partial match.
• Match details: Expand a result to compare the matched sequence, characters found in the pasted text, and the account's character set. The lookup field marks the positions of detected invisible characters.
• ⚠ Short-match warning: Results based on fewer than four consecutive characters are marked inconclusive because unrelated accounts can share short sequences. The displayed percentage describes sequence coverage, not the probability that an account caused the leak.
• Per-account fingerprint: Each account has its own shuffled character order. Administrators can view its character set on the user edit page.
• 🎛 Content controls: Choose which supported content types receive fingerprints and select the forums that hold private posts. The default is None, so select the desired types after installation. Forum selection applies to posts only.
• Length and density settings: Leave short content untouched and choose how many words separate inserted fingerprint characters.
• Code block protection: Skip code and preformatted blocks by default so copied code is not altered by fingerprint insertion.
• ♻ Fingerprint rebuild: Regenerate every account's character set with an explicitly confirmed rebuild task. Previously copied fingerprints can no longer be traced after a rebuild.

---

Supported Content Types:​

• XenForo: Forum posts in all forums or selected forums.
• XenForo Resource Manager: Main resource descriptions. Updates and reviews are excluded.
• 🖼 XenForo Media Gallery: Media descriptions on item pages and in the lightbox, plus comments on media items. Albums and album comments are excluded.

Resource Manager and Media Gallery support is available only while the corresponding add-on is active. Fingerprints are inserted when supported content is displayed; stored messages are not rewritten.

---

Permissions:​

• 🛡 Bypass message fingerprint (forum): Exempt users with the relevant forum permission from fingerprinting posts in that forum.
• 🛡 Bypass message fingerprint (Resource Manager): Exempt users from fingerprinting resource descriptions according to resource category permissions.
• 🛡 Bypass message fingerprint (Media Gallery): Exempt users from fingerprinting media descriptions and comments according to media category or album permissions.
• Check message fingerprint: Control which administrators can use the leak lookup page and see the character set on a user edit page.

---

Requirements:​

• PHP 7.4 or newer.
• Optional: XenForo Resource Manager for resource descriptions and XenForo Media Gallery for media descriptions and comments.

---

Useful for private communities:​

• Paid memberships: Investigate copies of member-only discussions or resource descriptions found outside the community.
• Private and staff areas: Check suspected reposts of restricted forum posts viewed by logged-in members.
• Leak investigations: Compare a recovered sample of exclusive content with possible source accounts while keeping the match length and uncertainty warning visible.

---

FAQ:​

• Which copies can carry a fingerprint? Supported content gains a fingerprint when it is rendered as HTML for a logged-in account, including eligible members viewing private areas. Raw BB code loaded by Reply, multi-quote, or the edit form does not carry it. Neither do email notifications, REST API responses, RSS feeds, search snippets, or thread previews.
• Which content is left untouched? Content below the configured minimum length is left as is. With Skip code blocks enabled, code and preformatted blocks are also left untouched so copied code stays intact.
• How much copied text should I check? Use the longest available sample. At the default interval of 10 words, a sample shorter than about 40 words may contain too few fingerprint characters for a reliable match. Treat a match as an investigative lead, especially when only a short sequence survives.
• Can it identify text copied before the add-on was enabled? No. Text must have been displayed with fingerprinting enabled to carry the account's character sequence.
• Can an old leak be checked after rebuilding fingerprints? No. A rebuild replaces every account's character set, so fingerprints copied before it can no longer be attributed using the new sets.
• Does a 100% Sequence match prove which account leaked the text? No. The percentage measures how much of the detected sequence matched. Short sequences can match many unrelated accounts; check the matching length and warning before drawing conclusions.

---

Screenshots:​

Leak Lookup​

Account Fingerprint​

Configuration​

Permissions​