Account takeover ticket triage console for support teams

Build me an account takeover triage console for our support team, using Zendesk and Have I Been Pwned. It should turn an "I think my account was hacked" ticket into a decision instead of a guessing game. This is a queue our agents work all day, not an alert they receive.

The main view is a queue of Zendesk tickets. A handler fetches them with Search Tickets using a saved query that covers our account security tags plus phrases like unauthorized login and suspicious charge, and the query should live in one place in the code so it is easy to edit. Each row resolves the requester with Show User to get their name and email address, then shows a live exposure summary for that email: how many known breaches it appears in, the date of the most recent one, whether it appears in any pastes, and whether its credentials show up in stealer logs. Let me sort or filter the queue so the tickets with the strongest exposure signal float to the top, and show ticket subject, requester, status, priority, and when it was last updated.

Opening a ticket gives me a two panel view. On the left, the full Zendesk conversation from List Ticket Comments, in order, with public replies and internal notes visually distinguished and each one attributed to its author. On the right, the requester's exposure history from Have I Been Pwned: every breach from Get Breaches for Account with the breach date and the exposed data classes, any appearances from Get Pastes for Account with source and date, and the website domains their credentials were captured against from Get Stealer Logs by Email. Call out the stealer log result prominently, because that is the signal that separates a plain credential stuffing victim from someone with an actively infected machine, and a password reset alone will not fix the second case. If I want more background on a specific breach, let me expand the row and pull the full record with Get a Single Breach.

From that same screen I need to act on the ticket. Using Update Ticket, let me write an internal note with the exposure summary already prefilled from what is on screen so I can edit rather than retype it, set the priority, and apply a tag. Show me clearly that the write succeeded and refresh the thread afterwards.

Add a "Draft the response" button that starts a background agent. The agent reads the whole ticket thread with List Ticket Comments, pulls the same exposure data for the requester with Get Breaches for Account, Get Pastes for Account, and Get Stealer Logs by Email, and writes a customer safe reply into the app for me to review. The draft lands in the app, not on the ticket. I read it, edit it, and then post it to the ticket myself as a public reply with Update Ticket. Show the agent's status while it runs and keep the last draft available per ticket.

Bake in the privacy rules, they are not optional. The app looks up the requester's own address only, taken from the Zendesk requester record, so there is no free-text box for checking arbitrary email addresses. The customer facing reply never repeats raw breach contents, passwords, or an itemised list of everything the person was exposed in. Instead it explains the reused password risk in plain language and gives the exact steps to take: change the password on our service to something unique, turn on two factor authentication, check for unfamiliar sessions or devices, and when there is a stealer log hit, run a malware scan and change passwords from a clean device because resetting from the infected one will just leak the new password too.

Some Have I Been Pwned specifics to get right. The breached account and paste account endpoints return HTTP 404 with an empty body when the account is clean, so render that as a verified clean result and never as a failure, and make that state visually distinct from a genuine lookup error so an agent can confidently tell a customer nothing turned up. URL encode email addresses in the path. Pass truncateResponse=false on the breach lookup so the detail panel gets DataClasses and BreachDate rather than just breach names. The stealer log endpoints need a Pro tier subscription, so read the entitlements at runtime from Get Subscription Status and hide the stealer log column and panel section entirely when the key does not include it, rather than showing a broken or empty section. Respect the rate limit on the key: the queue does one lookup per requester, caches the result for the session, and gives me a refresh control rather than re-querying every render.