Trust center
A security tool should be easy to question. Everything you would want to check about Plumbline is on these pages, including where it falls short.
Accuracy
Measured results: how many legitimate sites are wrongly flagged, how many look-alikes are caught, and what the domain checks alone miss.
Status
Whether the bot is up, how fresh the phishing blocklist is, and when scheduled jobs last ran. Read live from the service.
Data sources
Every feed and API Plumbline uses, its licence, and the ones that were checked and rejected.
Corrections
Results found to be wrong, what changed, and when. The log starts empty and stays honest.
Changelog
Every change to detectors and wording, because those change what a verdict means.
Security
How links are opened safely, how the service is protected, and how to report a flaw.
Privacy policy
What is stored, for how long, who else sees it, and how to erase it.
Terms of use
What a verdict is and is not, payments and refunds.
Who runs it
Plumbline is run by one person, Joshua Mhone. There is no company behind it and no investors. You can reach that person directly at joshuamhone9@gmail.com.
Plumbline is an independent project. It is not affiliated with or endorsed by Telegram, the TON Foundation, or any company or product named in its checks. Names are used only to say what a link appears to imitate.
How it is built to be questioned
- Reasons, not scores. Every verdict lists the concrete observations behind it, and says which checks ran and which could not.
- Dangerous needs hard evidence. Weak signals and community reports cannot reach it on their own.
- Never “safe”. The best result is “No known threats found”, and every result ends by saying that absence of findings is not a guarantee.
- Disputes are read. The “Wrong result?” button goes to the maintainer, and confirmed mistakes are published.
- Small data. Your Telegram id, plan, counters and 30 days of history, and one command that erases it all.
- Every change is tested and signed. Code changes pass automated tests, including an accuracy test, before release, and every commit is cryptographically signed.