Security breaking news

When people search for an incident or a vulnerability, the first thing they need is not the victim count or the root cause. It is whether they are affected and what to do today. That answer follows from which data items leaked (or may have leaked), or which versions are affected. So, as a rule, we publish the first report on the day of the official notice instead of waiting for the second one.

Every report puts the reader's actions first and the facts after them. What is still unknown goes into the status box at the top and into a known / not-yet-known table. We never fill gaps with guesses.

The source is the affected organization's own notice. When no official notice exists, we require at least two major news outlets to agree, and we say so in the article.

We keep the notice's wording apart: confirmed leaked, possibly affected, under investigation, explicitly excluded, or not mentioned. An item that is simply missing from a list is never described as safe.

Only the affected organization is named. Contractors, vendors, investigators and attackers are described by role. We never publish attack steps or exploitation details.

We check the official notice pages every day and rewrite the article on the day a follow-up appears. The body always shows the latest confirmed state; the history of changes sits in the change log at the end.

After publication, every item is checked against primary sources in a review step separate from writing. Corrections are made and dated in the change log.