How We Write and Verify Our Articles

The short version

Every factual claim in our articles comes from a source you can check yourself, every article shows when it was published and what data it is based on, and when we get something wrong we fix it in the open. Our articles are written for site owners making real decisions, so accuracy comes before speed and before length.

Where our facts come from

• Vulnerabilities: the official CVE record at MITRE (cve.org) and the plugin or software vendor's own advisory. When a draft and the CVE record disagree on affected versions, fixed versions or severity, the CVE record wins.
• Security incidents: the affected vendor's own notice first, then reporting from established security publications. News and vulnerability articles end with a Sources section listing them.
• Plugin data: the public wordpress.org plugin directory. When we publish our own research, we publish the dataset with it and describe the method, so anyone can check our numbers.
• Our own cleanup work: case studies are based on real engagements and anonymised. We remove client names, domains, code and anything that could identify the client, and we don't add numbers we didn't record.

How an article is checked

• Every version number, date, CVE ID, file path and command is checked against its source before publishing.
• Commands and procedures are ones we use in our own work. If we have not used something ourselves, we say where it comes from.
• We don't invent statistics, quotes or client stories, and we don't describe a threat as worse than its source does.
• We use AI tools to help with research and drafting. They don't publish anything: every article is reviewed and fact-checked by our team before it goes live, and the checks above apply to every line.

Dates and freshness

Each article shows its publication date, and an Updated date when it has changed since. News and vulnerability articles also state the date of the records they are based on, because advisories change after publication. When a vendor publishes new information, such as a root cause or a corrected version range, we update the article and its date.

Corrections

If you find an error, email contact@westoakbridge.co with the article link and what is wrong. We check every report against the source. When a correction changes the meaning of an article, such as a version number, a date or a recommendation, we add a dated correction note at the top of the article saying what changed. Typos and wording fixes are made without a note.

Independence

We don't publish sponsored content, and we don't take payment from plugin or hosting vendors to cover, rank or recommend their products. Our articles link to our own services where they are relevant, and we say so plainly: they are how we make a living. Security reports about our own website go through our vulnerability disclosure policy.