A port-authority vendor page advertises a public community server where points of contact use the same discriminator-style ID. How should that string be treated?
Select an answer to reveal the explanation.
Short Explanation
If they printed the community ID on the vendor page, it is a name tag in the lobby—not a secret handshake. Collect it like any other public username and see where that string shows up. Email is not the only pivot, and private inboxes are still not OSINT.
Full Explanation
When a port-authority vendor page advertises a public community server where points of contact use the same discriminator-style ID, that string should be recorded as a public username-class identifier and hunted for reuse on other public pages. Printing the ID on a vendor page places it in the open-source set even if the community software also has private channels. Ignoring it because only email addresses count as identity pivots arbitrarily narrows PORP methodology and misses a high-value rare string. Treating the discriminator as a password and trying it on city logins converts a public username into a credential-stuffing test. Scraping private direct messages from the community as the next OSINT step reaches content that is not public merely because a server exists. Exam caveat: PORP accepts public community discriminators as username pivots and rejects password trials or private-message scraping under an OSINT label. Operational check: extract the exact discriminator from the vendor page, search for reuse across public web and platform indexes, archive matches with dates, keep private channels out of scope, and never submit the string as a password to city or vendor systems. Port-authority vendor diligence benefits from treating community discriminators like any other rare public handle published on a corporate page.