---
title: "Corrections log. Lazaretto"
description: "Every verdict Lazaretto has published and later corrected, with what went wrong and what changed. Part of our dispute commitment."
url: "https://lazaretto.dev/corrections"
---

[Home](https://lazaretto.dev/) / [Trust](https://lazaretto.dev/trust) / Corrections

Accountability

# Corrections log

A security tool that never publishes its mistakes is asking to be taken on faith. This page is the opposite of that: every verdict we published and later corrected, what went wrong, and what we changed so it would not happen again.

**No dispute has been upheld to date.**

Read that precisely. It means nobody has reported a verdict of ours as wrong and been proven right yet. It is **not** a claim that our verdicts have all been correct, and you should not treat it as one. This is a young service with modest volume, detection is imperfect by nature, and a `clear` result can be wrong. An unbroken record is not something we could prove even if we had one, so it is not something we claim.

## How to dispute a verdict

If you publish an artifact and believe our `malicious` or `flagged` verdict is wrong, email [contact@lazaretto.dev](mailto:contact@lazaretto.dev) with the package or hash. Our commitment, which is referenced from the [Terms](https://lazaretto.dev/terms):

- A human decision on a disputed `malicious` verdict within **three business days**.
- An upheld dispute removes or annotates the indicator and invalidates the cached verdict for that hash immediately.
- It is listed on this page, with the cause.

## What we already publish about our limits

Corrections are the last line, not the first. We also say up front where a verdict is weaker than it looks: a scan that could not read part of an artifact says so, a known-bad check that could not run reports `null` rather than "no match", and an unpinned package with a version-scoped advisory returns "cannot determine" rather than a guess. See [where our data comes from](https://lazaretto.dev/sources) and the [disclaimer](https://lazaretto.dev/disclaimer).

We also publish how often we flag a package that turns out to be fine, measured on lists we publish in full, along with every attack sample of ours that goes undetected: [the benchmark page](https://lazaretto.dev/benchmark). A corrections log records the mistakes somebody reported to us; the benchmark records the ones we found by going looking.

Machine-readable: [/corrections.json](https://lazaretto.dev/corrections.json)

---

Machine-readable index: https://lazaretto.dev/llms.txt. OpenAPI: https://lazaretto.dev/openapi.json. MCP endpoint: https://lazaretto.dev/mcp. Any page on this site is available as markdown by adding .md to its path.