Shellshock Test

I've run a couple of these "testers" against servers I know are vulnerable by verifying at a shell prompt, and they they all report "safe" (with hedging language, of course).

Why is that? I don't mean to come across being entitled to any sort of free tester, but is it responsible to publish tools that definitely report "safe" when the underlying systems are not?

Nice.

Odd delay between getting the "probably safe" message and seeing it appear in my tcpdump.

Getting: 502 Bad Gateway It looks like it's down already