Look up the known breaches an email address appears in, returning breach METADATA only (name, date, data classes) and never passwords or leaked personal data. Uses the keyed Have I Been Pwned account API; when no API key is configured the route returns available false and the keyless password and domain routes still work. Breach indicators, not a guarantee.