Summary

Code review identified and fixes 10 bugs across sherlock.py, notify.py, and sites.py:

HIGH — Crashes

• NoneType crash when response is None — r.text and r.status_code were accessed in WAF detection and account detection logic without null checks. Network errors (timeout, proxy failure, etc.) return response = None, causing AttributeError on every detection path.

MEDIUM — Incorrect Behavior

• response_text bytes/str type mismatch — r.text.encode(r.encoding or "UTF-8") returns bytes, but the fallback assigns "" (str). Downstream consumers (CSV, display) expect str, causing TypeError when concatenating or writing.
• Global result counter gives wrong totals across multiple usernames — globvar was a module-level global never reset. Running sherlock user1 user2 would show cumulative count (e.g., "8 results" when user2 only had 3). Converted to instance variable, reset per-username in start().
• Dead None check on response_time_s in xlsx export — The list response_time_s was checked if response_time_s is None (always False since it's initialized as []). Individual query_time values were never checked for None.
• xlsx output ignores --folderoutput flag — CSV and TXT correctly write to --folderoutput, but xlsx always wrote to cwd.
• finish() called once after ALL usernames — start() was called per-username but finish() was outside the loop, so the summary only appeared once with a cumulative count.

MEDIUM — Security

• Excel formula injection in xlsx HYPERLINK — URLs from site data were directly interpolated into =HYPERLINK("...") formulas without sanitizing double quotes, allowing formula breakout.

LOW — Code Quality

• Unused username_unclaimed parameter in SiteInformation.__init__ — Accepted with default secrets.token_urlsafe(10) but immediately overwritten with secrets.token_urlsafe(32). Parameter value was never used.
• Unused error_type parameter in get_response() — Passed from call site but never referenced in the function body.
• Mutable default arguments [] — do_not_exclude and do_not_remove used [] as defaults, which are shared across calls in Python.
• Version tag parsing assumes v prefix — latest_remote_tag[1:] strips exactly one character, breaking if the tag has no v prefix. Changed to lstrip('v').
• Python 3.9 incompatible type hints — str|None and dict[str, ...] syntax doesn't work on 3.9. Changed to Optional and removed the return type hint.

Test plan

• Syntax validated for all modified files
• Existing non-live tests pass (live probe tests are flaky by nature — WAF detection on AllMyLinks)
• test_validate_targets.py passes (956 targets validated)
• Manual test: run sherlock user1 user2 --txt --csv --xlsx --folderoutput /tmp/out and verify per-username counts are correct
• Manual test: verify xlsx file appears in --folderoutput directory
• Manual test: verify no crash when network is unreachable (timeout scenario)

🤖 Generated with Claude Code