Talk to a person.
One address, read by the people who build this. No ticket number, no chatbot, no queue position.
Send a message
Everything except the subject is required. There is no CAPTCHA — this form uses a hidden field and a signed timestamp instead, so it stays usable with a screen reader.
Why there is no address here
A published address is harvested by spam crawlers within days — our own scraper-exposure check exists because of it. The form goes to the same inbox and reaches the same people, so nothing is lost by routing through it.
One inbox handles everything — support, corrections, privacy requests, press and security reports. There is nothing to route and no ticket queue to join.
Reporting a security issue
Use the form and put "security" in the subject, or the machine-readable route at /.well-known/security.txt. Report what you observed without probing further to establish how far it goes — that part needs permission a finder does not have.
Think a measurement is wrong?
That is the most useful message you can send. Every check publishes the observation behind
its verdict, so if the evidence and the verdict disagree, the rule is wrong and we want to
know. Include the URL and the check id — for example sec.csp — and it can be
reproduced immediately.
Common questions
How quickly will I get a reply?
Usually within a couple of working days. This is a small operation rather than a support department, so there is no guaranteed response time — but every message is read by someone who can actually change the thing you are writing about.
Do I need an account to use the API?
No. The REST API and the MCP server are both keyless and require no account, so there is nothing to provision and no credential to request. If you are hitting the rate limit — 40 audits an hour, 200 a day — write and explain the use case.
Can you audit a site behind a login?
No. Outrings measures what is publicly served, so a page behind authentication is seen the way any visitor sees it — as the login page. It never attempts to authenticate, and that is deliberate rather than a missing feature.
Will you remove my site from the public statistics?
Yes, on request. The public statistics are aggregates and never name an audited site, but if you would rather your hostname were not in the underlying data at all, ask and it will be removed.