Argus

02

What I found

The provider that can actually be bought returns a window, not an archive. The actor hands back the twelve most recent posts and silently ignores any request for more, so diffing that against a stored back catalogue would mark a whole archive gone on the first check: a deletion alert under a real person’s handle, for something that never happened. Restricted profiles were the second hole. Some accounts serve no posts at all to a logged-out reader, confirmed across two actors and a residential proxy, so an empty post list is not evidence of a missing post. And screening the pictures meant handling originals, which is the one thing a service like this must never keep.

• Next.js 15
• React 19
• TypeScript
• Supabase
• PostgreSQL
• Vercel
• Railway
• Apify
• Resend
• Telegram Bot API
• FastAPI
• Sentry
• node:test

04

What I built

A Next.js app on Vercel, a worker on Railway that claims due accounts atomically and has run unattended since 2026-09-19, and a Python sidecar that is the only process which ever decodes an original. Every provider declares its coverage, so absence is only evidence inside the window that was actually read; every attempt writes a snapshot, including the failed ones; and alerts reach email and Telegram on confirmation rather than on suspicion. The roster page sorts worst first and counts each row down to its own next check off the same column the claim query selects on, so a stopped worker shows on the page without anyone going to look. Four controls sit on each account: tracking mode, cadence, profile picture, and a removal that frees the plan slot while keeping every post and every deletion already found. What is stored from a picture is a perceptual hash defined here rather than in a library, the dimensions, and a blurred thumbnail at 0.7 to 2.6% of the original’s bytes. Health is scored twice a day, Instagram’s policy pages are crawled and diffed behind a human gate with a public changelog, and spend is metered per provider call.