Report a problem

Tell us what is wrong

A bug, a finding you think is inaccurate, or a security vulnerability. One form for all three, and it becomes a tracked issue rather than sitting in an inbox.

We collect nothing you do not paste

No analytics, no cookies and no third-party script, the same as every other page here, and our own scan asserts it on every page. Your address is used to reply and nothing else, and leaving it out is fine. Terminal output often contains a path with your name in it, a hostname, or a token: have a look before you paste.

What kind of report is this?

A security vulnerabilityFiled straight into our private repository, so sending it here does not disclose it. Leave a reply address and we will use it.A finding that looks wrongA false positive, a missed failure, or a rule we have described badly. This is the report we most want.Something is brokenA crash, a hang, an unhelpful error, or output that does not match what the docs say.The documentation is wrong or missingIncluding anything that was true once and is not any more.

What happened, and what you expected

Setsquare version

Playwright and axe-core versions

Node version and operating system

Terminal outputHave a look for a path with your name in it, a hostname, or a token.

Your emailThe only way we can reply. For a vulnerability, it is also the confidential channel back.

What makes a report easy to act on

What you expected, and what happened instead. Both halves.
The smallest reproduction you have, even if it is not small.
The versions. npx setsquare doctor --json prints most of them.
If a finding looks wrong, the rule id and the element. That is the report we most want, and the hardest to get.

What happens after you send it

Acknowledgement within two working days, an assessment within five, and an honest answer about timing. UK business hours, best efforts: we are three people and would rather say so than imply a rota we do not have.

A person reads every one. Reports that a finding is wrong go to the front of the queue, because an evidence product that reports the wrong thing is worse than one that reports nothing.