Content and evidence policy

Publication rules

• Primary sources are preferred and always linked.
• EPSS probability, CVSS severity, and CISA KEV exploitation evidence remain separate signals.
• Automatically extracted disclosure records stay in review until approved.
• Complete third-party report bodies are not republished by default.
• Potentially intrusive examples include explicit authorization and side-effect warnings.
• Material changes create a version event instead of silently rewriting history.