Source standards

Sources are ranked: primary official sources first, then original journalism, then specialist security press, then research and frameworks, then vendor research, then community signals.

Verified is used only for official advisories, regulator notices, standards-body publications, and provider security disclosures. An item is never labelled Verified because it appeared on a social platform, a forum, a code host discussion, or a vendor marketing blog.

Reported means a reputable newsroom reported it and we have not independently confirmed the underlying primary source.

Research, Emerging, Discussion and Opinion mean the item is offered for awareness. Verify relevance and severity before operational response.