Reporting abuse
If something this product does is landing on your website and you want it to stop, this is how to make that happen.
Write to report@stillworks.watch
One address, read by a person: report@stillworks.watch. You will get an answer within 24 hours.
What helps a quick answer: the domain the traffic is landing on, a rough time, and anything from your access log that identifies it. You do not need an account and you do not need to prove anything before anybody looks.
If it is your domain, it comes off
The owner of a domain can have it removed from this product, and that decision beats the wishes of whoever added it, even a paying customer who believes they are authorised. The owner is not asked to argue with the customer, and the domain is not put back at the customer's request alone.
Write to report@stillworks.watch from an address at the domain, or with something else that shows the domain is yours. A person removes it by hand, within 24 hours, and replies to say it is done. Any run already scheduled is dropped with it.
You can also say it without writing to anybody. Put a file at /.well-known/stillworks-optout on your domain and this product reads it automatically: before it takes your domain on at all, and again on a schedule for domains it is already watching. Nothing you have to prove, and nobody you have to convince — your answer beats the customer who entered the address, including one who is paying. Take the file away and it starts watching again, not on the first look but after several. The email above still reaches a person within 24 hours, and it is the way in if you cannot publish a file.
A page here about your site
Anybody can ask this product to look once at a public address, and can then publish what it saw as a page others can open. If somebody did that about a site you run, the page carries your address, sentences about whether the site answered, and the icon the site publishes for itself. It never carries a page of your site, a path within it, or anything from inside it, and it is kept out of search engines.
You can have it taken down. Write to report@stillworks.watch with the link, from an address at the domain or with something else that shows the domain is yours. A person takes it down within 24 hours and replies to say it is gone. From then on, this product no longer serves the snapshot, its findings or its old preview; the page and card say only that it was taken down. Another service or somebody who already received the link may still hold a copy or preview saved before the takedown, and this product cannot remove it from there. You do not need an account and you do not argue with whoever published it. The file at /.well-known/stillworks-optout works here too: it hides the pages already published about your domain and stops new ones from being made.
Left alone, one of these pages stops showing what the look found after two weeks and says so instead. It is one moment, not a live page, and it says that on its face.
What the product already refuses to do
Never more than one run against a single host at a time, whoever asked for it. A run from the landing page without an account is limited per visitor and per domain, three an hour and ten a day, and it never opens a browser.
Banks, public administration, healthcare, addresses that resolve to private or internal ranges, and anything in the protected categories the product will not touch are refused before the first request leaves, not when somebody later creates a project. The list of categories is not published, so that it is not learned around.
Where the product follows links on a site, it respects the site's robots.txt. It does not respect it for an address the customer typed in themselves, because they asked for that one.
Every run is written down with the domain it went to, so a complaint can always be answered with what actually happened rather than with a guess.
A security issue in the product itself
If you find a security issue in stillworks.watch, email security@stillworks.watch. Include enough detail to reproduce it, and avoid accessing or modifying data that is not yours. Reports are reviewed as quickly as reasonably possible. There is no bug bounty programme. The security page says what the product holds and how it is boxed in; a question about your own data is answered on privacy.