A housing-authority recon team uses AI during OSINT on publicly visible code hosting. Which use best fits authorized exposure triage?
Select an answer to reveal the explanation.
Short Explanation
AI as a sorting hat for public repos that spill city codenames—that's recon gold without touching anyone else's code. You're inventorying exposure, not vandalizing Git history.
Full Explanation
During authorized OSINT on publicly visible code hosting, AI is appropriately used to cluster and triage repositories that accidentally mention city project codenames or other municipal identifiers for exposure review. That supports defensive risk insight—finding what the agency already leaked—without modifying third-party projects or conducting exploitation. AI accelerates pattern grouping; humans still validate hits and file informational findings.
Quietly pushing malicious commits to third-party repos during recon fails by concept: that is unauthorized tampering and potentially criminal, not OSINT. Deleting other agencies' public repos to hide shared codenames is destructive interference outside assessment rights. Ignoring public code mentions because OSINT never includes developer artifacts is false; public technical artifacts are standard OSINT sources.
Exam caveat: Public repo triage can surface secrets, keys, or internal URLs—handle findings under data-handling rules and avoid exfiltrating more than needed to evidence exposure. Do not star, fork, or interact in ways that violate platform rules or ROE active-testing limits if the engagement is still in passive recon. Coordinate disclosure with the owning municipal program so remediation is possible.
Operational check: Limit AI prompts to indexing and clustering publicly readable repo text already collected under ROE; verify each codename hit in the primary source; open an informational exposure ticket for defenders; and confirm no write actions were taken against any remote repository during the recon phase.