Contact us
Email is the only channel, for a reason explained below. The most valuable message you can send is a detector that missed something it should have caught, or flagged something it should have left alone.
Logs Sanitizer is maintained by Dipesh Kumar, and this one address handles everything: a pattern the tool should recognise, a false positive that is getting in your way, a log format it handles badly, or a question about what a setting does. Every message is read, though no response time can be promised.
Reporting a security issue
Use the same address, and please start the subject line withSecurity so it can be picked out quickly.
If you believe you have found a way to make this page leak data — a bypass of the Content-Security-Policy, a cross-site scripting vector in the log rendering, a flaw that lets an original value be recovered from its replacement — please write first and allow a reasonable opportunity to fix it before publishing. Include the steps to reproduce, and the browser and version you used. These reports are genuinely welcome, and you will be credited if you would like to be.
Never send us a raw log
This is worth stating directly, because the instinct when reporting a bug is to attach the file that caused it. Please do not. A raw log is exactly the material this tool exists to keep out of inboxes, and email is a poor place for it: it is copied to servers you and we do not control, and it stays there.
Instead, reduce the problem to the smallest example that still shows it, and where you need to include real-looking data, invent it. If a detector is missing a genuine secret, you do not need to send the secret — send its shape: the prefix, the length, the character set, and where it appears in the line. That is enough to write a detector and it costs you nothing if the message goes astray. For a false positive, the sanitized output plus a note about what was wrongly replaced is usually all we need.
If you ever have to send something derived from a real log, sanitize it here first.
Why there is no contact form
A form would need to submit somewhere, and the whole design of Logs Sanitizer is that this page cannot talk to a server. The production site is served with a Content-Security-Policy containingconnect-src 'none' and form-action 'none', so the browser blocks both network requests and form submissions outright. That is what makes the promise about your log checkable rather than merely stated.
Adding a contact form would mean weakening that policy for every visitor, in order to save a few keystrokes on a page almost nobody visits. A mailto: link costs nothing and keeps the guarantee intact. You can read the served policy on thehome page or in the privacy policy.