How we look

The rules

• Public pages only. We request what any browser can request: pages, headers, certificates. Ordinary GET and HEAD requests, slowly, within a small cap.
• Never inside. We never log in, never submit a form, never guess passwords and never try to exploit anything.
• Three sightings. A problem counts only after we see it three times, at least ten minutes apart, with a timestamp and status code each time.
• Owner first, in writing. Findings about a site go to its owner privately, with the evidence. We never publish a site's name.
• Counts in public. What we publish, like the Open Door Index, is totals by kind of problem.
• Fixed means verified twice. After a fix, two later checks must come back clean before we call it done.