Report an issue
Grade disputes and issues with Sloptic itself are handled here.
Does a grade look wrong?
Because Sloptic reads an app from the outside like a visitor would, with no source code or spec, it can get things wrong. Every DAST tool does. It can miss a control or deduct points for something you handle elsewhere or might actually be the correct behavior. Tell us and we will look.
Email hello@sloptic.org with:
- The link to the report (with a UUID).
- Which check(s) you are disputing. Each finding carries an id, like sec-headers-002 for content security policy. You can find them in your report.
- What you think the right answer is and how you would check it.
Is Sloptic making requests to your site?
Sloptic grades what people submit to it, so someone will have pointed it at your app. If you want that to stop, email abuse@sloptic.org with the origin and we will block it from being graded again by anyone. No reason needed.
Security issues?
Funny enough, Sloptic grades other people's apps for exactly this. Email security@sloptic.org with what you found and how to reproduce it. We will not pursue you for good faith reports that stay in scope. Please note what is in and out of scope down below:
In scope: sloptic.org and its API ONLY.
Not in scope: load testing, denial of service, or anything aimed at grading, including app(s) Sloptic graded that are not yours. If you want to report grading problems, submit a grade yourself and then dispute it. The grader runs on a residential IP on a desktop, so please do not stress test it.
Anything else?
hello@sloptic.org. One person runs this for now so a reply may take a few days.