Editorial

Editorial Standards

How Lunaro News reports, sources, verifies, and corrects its journalism.

Last updated Aug 8, 2026

Our principles

Lunaro News reports on subjects where being wrong has consequences. A mistaken severity rating can send a team scrambling over nothing, or leave a real problem unpatched. These standards exist to make our process legible to readers, so you can judge how much weight to give anything we publish.

Three commitments underpin everything below: we say where information came from, we say how confident we are, and we correct errors prominently rather than quietly.

Sourcing

Every Lunaro article carries a source badge indicating the nature of its primary underlying material:

Official Advisory — a vendor, CERT, or government security advisory. Highest confidence for technical specifics.
Research Paper — peer-reviewed or preprint academic research, or a formal report from a security research firm.
Vendor Blog — a first-party company announcement. Reliable for what the company is doing; treated as an interested party on framing.
Community Report — mailing lists, maintainer discussions, issue trackers, and practitioner accounts. Valuable and often earliest, but individually less verified.
Verified Source — information confirmed independently by Lunaro through direct contact with named parties.

Verification

Before publication, reporting on a security incident or vulnerability must meet the following bar:

Technical claims are traced to a primary source — an advisory, a commit, a paper, a proof of concept — not to another publication's summary of one.
Severity and exploitability claims are attributed to whoever made them. Where we characterise severity ourselves, we say so and explain the reasoning.
Where a vendor, maintainer, or named party is criticised, we seek comment before publication and note if none was received.
Where facts are contested or unconfirmed, the article says so explicitly rather than choosing the more dramatic version.
Numbers — victim counts, financial losses, affected installations — are attributed to their source and described as estimates where they are estimates.

Vulnerability disclosure practice

Lunaro News does not publish working exploit code, and does not publish technical detail sufficient to weaponise an unpatched vulnerability where a patch is imminent or the affected parties have not had reasonable opportunity to respond.

We honour coordinated disclosure embargoes we have agreed to. If we learn of an unpatched vulnerability under active exploitation, we weigh readers' need to defend themselves against the risk of expanding the pool of attackers, and we generally publish defensive guidance — indicators, mitigations, affected versions — ahead of offensive detail.

If you are a researcher or vendor and believe our coverage of a vulnerability creates unnecessary risk, contact us at security@lunaro.news and we will review it promptly.

Use of AI in our newsroom

Lunaro News does not publish AI-generated articles under human bylines. Every byline on this site represents a person who reported, wrote, and stands behind that piece.

We do use automated tooling in clearly bounded ways: aggregating and deduplicating headlines from public RSS feeds, ingesting and normalising vulnerability records from the National Vulnerability Database, and computing the trending and related-article rankings. These are mechanical operations on public data, and none of them produce prose that appears as editorial content.

If that ever changes — if we publish anything substantially machine-written — it will be labelled as such on the article itself, not disclosed only in a policy page.

Conflicts of interest

Lunaro journalists are required to:

Disclose to editors any financial interest, employment history, or personal relationship relevant to a subject they cover.
Recuse themselves from coverage of any company where they hold a material financial position beyond a diversified fund.
Decline gifts, paid travel, and hospitality from companies they cover. Where attendance at a vendor event is editorially necessary and the vendor has covered costs, that is disclosed in any resulting article.
Disclose relevant prior employment in the article itself when covering a former employer.

Advertising and editorial separation

Advertisers and sponsors have no input into editorial content, no advance notice of coverage, and no ability to review articles before publication. No commercial relationship confers favourable coverage, and no commercial relationship protects a company from critical coverage.

Sponsored content, where it appears, is labelled as sponsored, visually distinct from editorial, and never presented under a Lunaro journalist's byline. We do not accept payment to remove or amend published reporting.

Frequently asked questions

Does Lunaro News use AI to write articles?

No. Lunaro News does not publish AI-generated articles under human bylines. Automated tooling is used only for aggregating public RSS headlines, ingesting vulnerability records from the National Vulnerability Database, and computing article rankings — never for producing editorial prose.

Does Lunaro News publish exploit code?

No. Lunaro News does not publish working exploit code, and withholds technical detail sufficient to weaponise an unpatched vulnerability when a patch is imminent or affected parties have not had a reasonable opportunity to respond. Defensive guidance such as indicators, mitigations, and affected version ranges is prioritised over offensive detail.

Can companies pay for coverage on Lunaro News?

No. Advertisers and sponsors have no input into editorial content, no advance notice of coverage, and no ability to review articles before publication. Lunaro News does not accept payment in exchange for coverage, favourable framing, or removal of published reporting. Sponsored content is clearly labelled and never carries a journalist's byline.

How does Lunaro News verify security claims?

Technical claims are traced to primary sources such as vendor advisories, commits, or research papers rather than other publications' summaries. Severity and exploitability claims are attributed to whoever made them, contested facts are labelled as contested, and named parties facing criticism are approached for comment before publication.

Questions about this page? Read more about Lunaro News or see our full FAQ.

Our principles

Three commitments underpin everything below: we say where information came from, we say how confident we are, and we correct errors prominently rather than quietly.

Sourcing

Every Lunaro article carries a source badge indicating the nature of its primary underlying material:

Official Advisory — a vendor, CERT, or government security advisory. Highest confidence for technical specifics.

Research Paper — peer-reviewed or preprint academic research, or a formal report from a security research firm.

Vendor Blog — a first-party company announcement. Reliable for what the company is doing; treated as an interested party on framing.

Community Report — mailing lists, maintainer discussions, issue trackers, and practitioner accounts. Valuable and often earliest, but individually less verified.

Verified Source — information confirmed independently by Lunaro through direct contact with named parties.

Verification

Before publication, reporting on a security incident or vulnerability must meet the following bar:

Technical claims are traced to a primary source — an advisory, a commit, a paper, a proof of concept — not to another publication's summary of one.

Severity and exploitability claims are attributed to whoever made them. Where we characterise severity ourselves, we say so and explain the reasoning.

Where a vendor, maintainer, or named party is criticised, we seek comment before publication and note if none was received.

Where facts are contested or unconfirmed, the article says so explicitly rather than choosing the more dramatic version.

Numbers — victim counts, financial losses, affected installations — are attributed to their source and described as estimates where they are estimates.

Vulnerability disclosure practice

If you are a researcher or vendor and believe our coverage of a vulnerability creates unnecessary risk, contact us at security@lunaro.news and we will review it promptly.

Use of AI in our newsroom

Lunaro News does not publish AI-generated articles under human bylines. Every byline on this site represents a person who reported, wrote, and stands behind that piece.

If that ever changes — if we publish anything substantially machine-written — it will be labelled as such on the article itself, not disclosed only in a policy page.

Conflicts of interest

Lunaro journalists are required to:

Disclose to editors any financial interest, employment history, or personal relationship relevant to a subject they cover.

Recuse themselves from coverage of any company where they hold a material financial position beyond a diversified fund.

Decline gifts, paid travel, and hospitality from companies they cover. Where attendance at a vendor event is editorially necessary and the vendor has covered costs, that is disclosed in any resulting article.

Disclose relevant prior employment in the article itself when covering a former employer.

Our principles

Sourcing

Verification

Vulnerability disclosure practice

Use of AI in our newsroom

Conflicts of interest

Advertising and editorial separation

Frequently asked questions

Does Lunaro News use AI to write articles?

Does Lunaro News publish exploit code?

Can companies pay for coverage on Lunaro News?

How does Lunaro News verify security claims?

One email, every weekday morning. The stories that mattered, none of the noise.

Our principles

Sourcing

Verification

Vulnerability disclosure practice

Use of AI in our newsroom

Conflicts of interest

Advertising and editorial separation

Frequently asked questions

Does Lunaro News use AI to write articles?

Does Lunaro News publish exploit code?

Can companies pay for coverage on Lunaro News?

How does Lunaro News verify security claims?