Documentation

Investigating Leaks

Upload leak artifacts, read forensic reports, and share results.

Upload a leaked file or paste text
Upload the leaked artifact
Link to the original sent message
Match against sent versions
Ranked investigation report with confidence scores
Get a ranked forensic report

When confidential content appears where it shouldn't — forwarded email, Slack screenshot, news article, photo of a printout — LeakLocked compares the leaked artifact against every individualized copy you sent.

How investigation works

Upload leak artifact  →  Link to original sent message  →  Match signatures  →  Ranked report
  1. Upload — paste text or upload a screenshot, photo, or file.
  2. Match — LeakLocked compares extracted text against every sent version (OCR runs automatically on images).
  3. Report — recipients are ranked by matched signature options and confidence score.

Start an investigation

From a sent message or sent file:

  1. Open the original in Sent (or Files).
  2. Click Upload Leak.

Provide the leaked artifact in any of these forms:

Input Examples
Paste text Copied email body, excerpt from a document
Upload file Screenshot, photo of a screen, PDF excerpt

LeakLocked runs OCR on images automatically.

You can also view past investigations under Investigations in the sidebar.

Read the report

The investigation report shows:

  • Top match — most likely source recipient with confidence score
  • All scores — ranked list of every recipient who received the message
  • Highlighted matches — signature options found in the leaked text
  • Link to original — the sent message and all versions

Even partial leaks (a paragraph, a cropped screenshot) can produce useful matches when multiple signatures align.

Interpreting results

Signal What it suggests
High match score, multiple signatures matched Strong attribution to that recipient's version
Low scores across all recipients Leak may be from an unmarked copy, heavily edited content, or a different source
Partial text match Still useful — multi-layer scoring is designed for incomplete leaks

Use ranked results as supporting evidence for HR, legal, or security review — not as sole proof of intent.

Share with stakeholders

  • Download the uploaded artifact from the report.
  • Link stakeholders to the original sent message for context.
  • Export or screenshot the ranked results for incident records.

Tips for faster, more accurate investigations

  1. Investigate promptly — upload leaks as soon as they are discovered.
  2. Link to the correct original — select the sent message or file that matches the leaked content.
  3. Include as much text as possible — longer excerpts give more signature matches.
  4. Try both paste and upload — for screenshots, upload the image; for text excerpts, paste directly.

Next steps