#3121·sherlock

enhancement: warn when 100% of site queries failed (currently byte-identical to a legitimate 'not found' run)

Author: twelfthlaborCreated Sep 10, 2026Updated Sep 10, 2026

Summary

With default output settings, a run where every site query failed (dead proxy, mass timeouts, network down) is indistinguishable from a run where the username legitimately exists nowhere — and exits 0:

$ sherlock --timeout 5 --site GitHub --site Keybase --proxy socks5://127.0.0.1:9 daniel
Using the proxy: socks5://127.0.0.1:9
[*] Checking username daniel on:

[*] Search completed with 0 results      # exit 0, no warning
... (remaining banner lines omitted)

Evidence (code-level, offline)

  • Request failures leave query_status = UNKNOWN (sherlock.py:394-395); UNKNOWN only prints under --print-all (notify.py:218-225).
  • countResults() only counts CLAIMED (notify.py:197), so the summary is Search completed with 0 results.
  • Demonstrated: default output for a 3× UNKNOWN (dead proxy) run is identical to a 3× AVAILABLE (genuinely absent) run — the only difference is the Using the proxy: echo line that --proxy itself prints.

Why this is a gap (not per-site noise)

The per-site silence is deliberate design (#747 → 55abaf3 added --print-all to keep default output to found sites only) — no argument there. But there is no aggregate failure signal at all. A fully failed run silently reports "nothing found", which materially misleads users — e.g. open #2392 ("Most of the results are 'Error connecting'") looks like exactly this confusion.

Proposal (conservative)

After the per-username loop in main(), when every result for a username is UNKNOWN, print one line to stderr:

[!] Warning: all N site queries failed (errors/timeouts) — check network/proxy, or use --print-all for per-site details.

This respects the "default output = hits only" design (one aggregate line, not per-site noise). Explicitly NOT proposing here: per-site default output changes (would contradict the design intent above) or non-zero exit codes (breaks scripting assumptions) — those are maintainer calls if ever wanted.

Source: sherlock-project/sherlock