General contact
For questions, feedback or privacy requests, email [email protected].
Bug reports and feature suggestions can also be filed as issues in the GitHub repository.
Report a data error
If a version range, fixed version, branch date, CVSS score or website check result looks wrong, please let us know. You can open an issue on GitHub or email [email protected].
A useful report includes:
- The advisory, CVE or GHSA ID involved, if any.
- The PHP version or website URL you checked.
- What PatchScope showed, and what you expected instead.
- A link to a source supporting the correction, preferably an official PHP source such as php.net, the PHP ChangeLog or a php-src security advisory.
- The data snapshot’s “coverage through” date shown in the checker, if available.
Corrections are reviewed and applied through the same validated update process described in the methodology.
Security vulnerabilities in PatchScope
If you believe you have found a vulnerability in patchscope.evoa.one or in the PatchScope code, email [email protected]. Do not open a public GitHub issue for security problems. Scope, rules and disclosure expectations are described in the security policy. Our security.txt file is available at /.well-known/security.txt.
Vulnerabilities in PHP or WordPress
PatchScope does not handle vulnerabilities in third-party software. Please report them upstream:
- PHP: follow the php-src security policy or email [email protected].
- WordPress core: see WordPress security and the WordPress HackerOne program.
- WordPress plugins and themes: contact the plugin or theme author directly.
Questions about PatchScopeBot
If you run a website and noticed requests from the user agent PatchScopeBot/1.0 (+https://patchscope.evoa.one/methodology), someone used the Website Security Checker on your site. The checker sends a small number of passive requests and does not crawl, fuzz or submit forms; details are in the methodology. You can block that user agent at your web server or firewall. If you believe the scanner was used abusively against your site, email [email protected] with the approximate time and your hostname.
Response times
PatchScope is maintained by a small team. We respond on a best-effort basis. Security reports are prioritized, with a target of acknowledgement within 5 business days.