You're scamming people.
A public record of products that sell quality and never deliver it.
Security, performance, UI/UX and accessibility, measured with public tools against what the product already exposes. Every case is reported to the vendor and only published once it is closed, without naming who caused it.
We measure. We do not speculate.
You charge like premium. You ship a demo with an 11-second LCP.
Registry status
These figures come from the cases published in this repository. None are hand-written: if it says zero here, there is nothing to show yet.
- In progress
- 1
- Reported
- 1
- Published
- 0
- Median time to fix
- no data
No cases published yet. The first one is being verified: it goes live once remediated, or 90 days after the report, and always anonymized. An inflated counter would be exactly what this project documents.
Published cases
All of them happened. None names who caused it. They go live only once the case is closed and the four anonymization axes have been applied.
No cases published yet
A case appears here only once it is remediated and verified, or after 90 days with no response. While the vulnerability is still live, publishing it would be handing anyone the map.
Latest activity
Every entry is a fact about the process, not an opinion: when it was reported, when it was acknowledged, when it was fixed.
No published activity yet
The first case is reported and its clock is running. Once it closes, its milestones appear here with days relative to the report.
How we get to each case
Only what the product already exposes gets looked at — no credentials tested, nothing forced. The finding goes to the vendor, a 90-day clock runs, and only then is it published, with no name, domain or paths.
See the full methodBack the project
Reporting is free and always will be. We do not charge for staying quiet, we do not attach an audit pitch to a report, and we take no money from anyone we have analyzed.
Buy me a coffeeContributions cover the domain, infrastructure, and the time it takes to follow each case through. Nothing else.
Get on the list
We will let you know when the first reports go live.