Editorial & disclosure policy
The rules we hold ourselves to. If we break one, call us on it.
Independence
Cyber Palava is editorially independent. No government agency, vendor, sponsor or advertiser sees a story before it is published or has any say in what we cover. Sponsored content is always labelled as sponsored and never appears in our threat intelligence or vulnerability coverage.
Vulnerabilities and exploits
We write about vulnerabilities only once the vendor, a national CERT or the researcher who found the flaw has disclosed it publicly. We explain what is affected, how serious it is and how to fix or mitigate it. We do not publish working exploit code, step-by-step exploitation instructions, or details that would help an attacker more than a defender. If you have found a flaw, report it to the vendor first. We are happy to help you find the right contact.
Breaches and threat groups
We report incidents that are public: acknowledged by the organisation or a regulator, or publicly claimed by an attacker or credible researcher. We say clearly which is which, and a claim by a criminal group is reported as an allegation, never as fact. We do not publish leaked personal data, and we do not link to leak sites. Attribution of an attack to a group or country is stated with our level of confidence, and we update it when the evidence changes.
How we use AI
We use AI tools, including Claude, to monitor sources, summarise advisories and draft first versions of some stories. Every piece a reader sees has been checked by a named human editor against primary sources before publication. Bylines say how a piece was made:
- By [name]: written by a person.
- Drafted with AI, reported and verified by [name]: AI wrote the first draft; the named editor checked every fact, figure and source and is accountable for it.
- The Bot Column: a clearly labelled weekly column written in the voice of our resident machine, checked by a named editor. It is opinion and humour, not news.
We never let AI invent quotes or make claims about real people that a human has not verified.
Automatic roundups. Some recurring roundups (for example a daily brief or a weekly list of exploited flaws) are compiled automatically by AI and may be published before an editor has read them. These pieces carry the byline "Autopilot" and say so at the top. They are built only from public material our desk has already collected, every item links to its source, they never include unconfirmed claims as fact, and they are never built from information shared with us in confidence. Editors review them after publication and correct them through our normal corrections process.
The Wire is different. It is a curated list of headlines from other trusted outlets, picked automatically by our software and checked through the day by our editors. Each headline links to the outlet that reported it; the one-line summary under it is written by AI from that headline and stays strictly to what the source says. Editors can pin, correct or remove any item.
Information shared with us in confidence
We follow the Traffic Light Protocol (TLP). Only information marked TLP:CLEAR, or with no restriction, is ever published. Material marked TLP:GREEN, AMBER, AMBER+STRICT or RED stays inside our newsroom: it is never published, never posted to social media and never used for automatic roundups, and by default it is not sent to outside AI services.
Free tools
Our free tools give general information, not professional, legal or financial advice. They are automated, rely only on what you enter and what is publicly visible, and can be wrong or incomplete. The message checker lists common warning signs; it does not and cannot tell you whether a message is genuine or fraudulent. The email and website checks report what our server could see at that moment; they are not a security audit. The checkup is based only on your answers. We do not store what you type into the tools beyond a short cache of domain results, and we do not use it for anything else. Before acting on a result, check directly with the organisation concerned or a qualified professional.
Humour
We think security writing can be fun. Our jokes are aimed at the absurdity of the situation, at the industry, and at the attackers. They are never aimed at victims, and we play it straight when people have been harmed.
Corrections
When we get something wrong, we fix it, say so at the bottom of the story, and log it publicly on our corrections page. Developing stories are marked as such and updated as facts change.
Sources and tips
We protect our sources. If you want to share information confidentially, use our secure tip line. We will never knowingly publish information obtained illegally or in breach of an official duty of confidence.