Before anything is published
No assessment is published without the operator having seen it first. The findings are sent to the operator in full, unredacted and with the product identified, before publication and with a stated window to respond.
The window is normally 30 days. It is shortened only where the conduct is live, reaches accounts registered as minors, and appears to be correctable without engineering work. Where a shorter window is used, the reason is recorded in the assessment itself.
The disclosure record for each assessment — the address used, the dates, whether a response arrived, and what changed as a result — is published with it. Entries are made on the day the event occurs rather than reconstructed afterwards.
Factual errors
If an assessment states something that is factually wrong, it gets corrected. That applies before publication and after it, and it applies whether the error is found by the operator, by a reader, or by me.
Corrections are handled the same way every time:
- The correction is made at the finding it affects, not only in a note at the end.
- The change is dated and described, so a reader can see what the document said before.
- Where a correction removes the basis for a finding, the finding is withdrawn and marked withdrawn. It is not quietly deleted.
Corrections are not conditional on how the error is raised, on who raises it, or on anything being agreed in return.
Disagreement about interpretation
Some disputes are not about facts. An operator may accept every observation and read the legal or practical significance differently. That is a reasonable position and it is treated as one.
Where an operator disputes an interpretation rather than a fact, both readings are presented in the document, with the operator's reading stated in its own terms rather than paraphrased into weakness. The finding is not removed, and the disagreement is not hidden in a footnote.
Right of reply
An operator may have its response published in full, alongside the assessment, at any time. This is an open offer and it does not expire when the pre-publication window closes.
- The response is published as written, not summarised or excerpted.
- It is placed with the assessment, not on a separate page.
- There is no length limit within reason and no editing beyond removing anything that would identify an individual user.
- If the operator would rather its response were not published, that choice is recorded and the response is not published.
What is not offered
Being direct about this is fairer than leaving it to be discovered later.
- Findings are not removed because they were subsequently fixed. Remediation is recorded, dated, and noted at the finding — which is more useful to a reader than deletion, and it preserves the incentive to fix quickly. An assessment that quietly deleted remediated findings would be misleading about what the product did.
- Publication is not withdrawn in exchange for anything — not access, not commercial work, not a commitment to remediate.
- An assessment subject is not solicited as a client while the assessment is open, and where a company was on a prospecting list before it became a subject, that fact is disclosed in the assessment.
How to raise something
Email rhiannalitchfield@gmail.com. Corrections and replies are read and acknowledged whether or not they come through counsel, and an operator does not need to route it through counsel to be taken seriously.
Supporting evidence for any published assessment — screenshots, session logs, and archived copies of the documents quoted — is available to the operator of the assessed product on request.