Contact
One form for everything — a bug, a question, a security disclosure, or a request to read the source. Pick the subject and the message is routed by it. No account, and nothing to sign up for first.
01 / Write
The subject decides how the message is handled: a disclosure is read before anything else, and never in public.
02 / Check first
Worth a minute before writing anything up — each of these is working as designed, and each one looks like a bug.
Check whether it expired or ran out of views. Both are final and neither can be reversed, by you or by us. Check too that the whole URL survived the trip — some clients truncate at the #, and everything after it is the decryption key.
A share restricted to named recipients or to a domain requires the reader to sign in, so there is an identity to check the list against. Remove the restriction if that is not what you wanted.
ExpectedRegion and IP checks fail closed. When the source information is missing or cannot be trusted, the request is denied rather than allowed through — including behind some VPNs and corporate proxies.
Expected03 / Bots
A public inbox attracts machines. This one is defended without asking you to identify traffic lights, and without loading a line of code from anyone else.
Your browser solves a small puzzle the server sets — a fraction of a second, once. A sender pays that per message, which is cheap for one and ruinous for a million.
Proof of workThe form carries a decoy input. You will never encounter it; a script that fills in every field it finds will, and that message goes nowhere.
HoneypotA captcha would mean loading a script from another company onto a page that handles credentials, and relaxing the policy that forbids exactly that. The trade is not worth making.
No trackers