Get in touch

False positive, a correction to a guide, a vulnerability report or a question about a result: this is the place.

Illustration of a message being sent to the Scan.now team

Send us a message

Every message reaches a person, not a queue. We answer most within three working days, and we answer corrections fastest — a wrong finding in a report is the one thing we drop other work for.

Before you write

Wondering what a finding means? The checks reference has a page per check.
Think a result is wrong? Include the report link (it starts with /r/) so we can reproduce it.
Found a vulnerability in Scan.now? See responsible disclosure.

Reporting a false positive

This is the message we most want to receive, and the one we act on fastest. We sell the idea that our findings are correct, so a wrong one is a defect rather than a difference of opinion. Send the report link and, if you can, what you believe the correct result is. We re-run the check by hand, against the live host and against a second implementation, before changing anything — and if the check was wrong we fix the check, not just your report. How we scan describes what each scanner does on the wire, which is usually enough to see where a disagreement comes from.

Asking us to remove a report

Reports live at an unguessable link for 30 days and are served noindex, so they never appear in a search result. If one still needs to go sooner, send the link and it is deleted, no questions asked and no account required. We do not ask you to prove you own the site: There is nothing in a report that is not visible to anyone who visits it.

Corrections to a guide or a check page

Our guides and check pages cite the RFCs, specifications and vendor documentation they are tested against, and standards move. If something has gone out of date, or was wrong to begin with, tell us which page and what changed — a link to the source helps most. Corrections are made in place and the page’s update date changes with them, which is set out in our editorial policy.

What we cannot help with

We are not able to scan a site you do not control, investigate an account compromise on someone else’s service, or act as an incident-response team. If you are in the middle of a live incident, the fastest route is your hosting provider and, for a compromised site, our guide on what to do after a compromise.