These are the standards we hold our writing to.
Practical over theoretical
We write for teams that have to ship. An article should leave the reader with something they can do: a rollout order, a checklist, a configuration change, a decision framework. We say when advice depends on team size, budget or risk tolerance.
Independence
Our editorial decisions are ours. Sponsored content, if any, is labeled as such (see below) and kept distinct from our own articles. Tool comparisons are based on documented features and trade-offs.
Sourcing
- We link to vendor documentation, standards (such as OWASP, NIST and the relevant RFCs) and public incident reports where we rely on them.
- We say when a claim comes from a vendor’s own marketing or from a single source.
- We do not present estimates or our own judgment as established fact.
Dating and updates
Articles show their publication date and, when changed, an updated date. Security advice ages: tools change, vendors change defaults, new attacks appear. When something in an article stops being true in a way that matters, we update it and say so.
Guest contributions
We publish guest articles from practitioners. Guest posts go through the same editing as staff articles, carry the writer’s byline, and may include at most one contextual link to the writer’s site or profile. See Write for Us.
Sponsored content
Content that is paid for or sponsored is labeled as such at the top of the article, before the reader reaches the content. See Advertise.
Corrections
We correct errors when we find them or when readers point them out. See corrections.
Contact
To report an error, suggest a topic or ask about this policy, see the contact page.