Disputes and remediation
How to challenge a report about your project, what happens next, and how the Remediated badge works.
If a report about your project is wrong, or it was right and you've fixed it, there's a path for that. We read every dispute and a person answers it.
Who can dispute a report
Anyone. Every published report has a "Dispute this report" link.
You'll be asked how you relate to the content — owner, maintainer, or someone else — because it helps us prioritise, not because it decides the outcome. A good argument from a stranger beats a weak one from an owner.
What to send
- The claim. Either "this isn't a prompt injection" or "this was, and it's fixed", or something else you'd rather explain in your own words.
- Your reasoning, in a few sentences. What the file actually does, what we misread, what you changed.
- An email address we can reply to. It's never published.
- A link to evidence, if you have one — a commit, a pull request, a doc. We store the link, we show it defanged, and we never fetch it.
One open dispute per report at a time. If yours is already open, adding a second won't move it faster; reply to the thread instead.
What happens next
- Received. You get an email confirming it, and the report shows an open-dispute marker so readers know it's contested.
- Reviewed. A person reads the report, your statement and the evidence. If the claim is that it's fixed, we run a fresh scan of the target.
- Decided. One of three outcomes.
- Published. The outcome and a short note from the reviewer appear on the report. That note is public; your email address and personal details are not.
The outcomes
We agree it's a false positive. The report comes down. If the mistake is instructive we may keep a corrected version with a note about what we got wrong; if it isn't, it just goes.
You fixed it. The re-scan comes back clean, the report keeps its history, and it gains a Remediated badge: "the owner fixed this and a re-scan came back clean." The record stays honest — it happened — but anyone reading it sees that it's dealt with. Fixing something should look good, and here it does.
We stand by it. The report stays up with your side of it noted. We'll tell you why, and you're free to disagree in public. If you have something new, send it and we'll look again.
How long it takes
- Confirmation: straight away.
- A human reply: within five working days. Usually much sooner.
- A re-scan for a remediation claim: within a day of the review starting.
If you haven't heard from us in five working days, chase us at [email protected] — something went wrong on our side.
A few honest notes
- Taking the content down doesn't erase the report. It changes the status to removed, and lowers the score, because content nobody can reach is less dangerous. The record of what was there stays.
- We don't remove reports on request alone. "Please take this down" without a reason gets a polite reply asking for one.
- We'd rather be corrected than right. A registry that never admits a mistake isn't worth reading. If we got it wrong, saying so publicly is the job.
- Found a security problem in Malprompt itself? That isn't a dispute — see security and disclosure.