What we caught checking our own outreach.
Nexertise's product is a check: did a real, specific person actually see and respond to this, not a bot and not the same person twice. We run the company itself with the same instinct turned inward. On October 14, 2026, closing out the day's cold-outreach count, our own Head of Growth found that the team had broken its own contact rules three times in the prior 85 sends, and every individual send had looked clean.
Here is exactly what broke, how it was found, and what changed the same day.
Marcus Hale, SEO and Content Lead, Nexertise · Published October 16, 2026
What happened
Two rules exist to stop the same company hearing from us twice in a way that reads like scraping: at most three people contacted per company, and never a second person at one company from a second mailbox. Over two days, in 85 cold sends across our nine team mailboxes, three companies breached one of these.
| Company | What happened |
|---|---|
| PlanetScale | A fourth person contacted from the same mailbox, one over the three-per-company cap. |
| Sentry | A second person contacted from a second mailbox, one day after the first. |
| Modal | The same cross-mailbox pattern, both mailboxes run by the same teammate. |
No bounce, no spam complaint, and no opt-out came from any of the nine people this touched. The harm wasn't deliverability. It was that three companies would have heard from two different “people” at the same outside firm within a couple of days, which reads like the kind of scraped, uncoordinated outreach a real company notices and distrusts.
Why the per-send check didn't catch it
Every one of those 85 sends passed its own pre-send check: was this specific address already suppressed, had this specific person been written to before. That check is denominated in addresses: it answers “have I written to this one inbox.” Both outreach rules are denominated in companies: they ask “has anyone on my team written to this organization.”
No single-address check, run by a single sender before a single send, can see across nine separate mailboxes to answer a question about the company on the other end. The gap wasn't a missed step; it was a question nobody's per-send check was built to ask.
How it surfaced anyway
It didn't come from a sweep built to find it. It came from someone doing an unrelated, ordinary task: closing out the day's running send count across every mailbox, which meant reading all nine logs side by side for the first time. The pattern was only visible once the nine separate, individually-correct mailboxes sat in the same view.
The fix, same day
A mandatory company-name search across every mailbox's log, run before any new cold send, was added to the top of the two files the team reads first when sourcing a new batch. The check that was missing (one company, seen from every mailbox at once) now runs before the per-address check that already existed, not instead of it.
The part worth saying plainly
We didn't stop sending cold email over three breaches in 85 sends with nobody complaining. That would have cost far more than it prevented. We also didn't quietly fix it and move on.
The reason this is written up at all is that it's the same lesson our own product is built on: a check that only ever looks at one record at a time will pass things that are only visible once you look across records. We build that cross-record view for advertisers checking whether their engagement is real. This week we needed it pointed at ourselves, and the honest result is that we built a worse version of our own idea before we caught it.
Marcus Hale is the SEO and Content Lead. The figures above are drawn from the team's own compliance log, read in full on October 16, 2026, and are stated as of October 14, 2026 (the day of the finding), not rounded to a later total. The three company names are public facts about who we emailed, kept here because naming them is what makes “we checked ourselves” verifiable rather than a vague claim. Individual teammates aren't named; the point is the habit of checking, not any one person's mistake.
See the cross-record check we build for advertisers
The same instinct that caught this, pointed outward: how we verify that engagement on a campaign is real. Or read another honest account of how the team actually works.