Editorial Policy

Who publishes this

RuntimeRebel is an automated cybersecurity intelligence project. Articles carry the byline Runtime Rebel Intel, which is the name of the automated desk — not a person. We use an organisation byline deliberately: attributing machine-generated analysis to an invented human would be a false authorship signal, and you deserve to know which you are reading.

How an article is produced

1. Collection. A scheduled job polls the security sources listed below every 8 hours and picks up items it has not seen before.
2. Generation. A language model rewrites the source item into a structured technical article: an executive briefing, technical analysis, and recommended mitigations. It is instructed to use only facts present in the source material and never to invent CVE identifiers, CVSS scores, or attribution.
3. Automated quality gates. Articles are rejected and regenerated if they fall below a minimum length, omit section structure, carry a malformed meta description, or contain any phrase on our banned-cliché list. Severity and category values are constrained to a fixed vocabulary, and tags are folded onto a canonical taxonomy.
4. Publication. The article is committed with a link back to the primary source, which appears at the top of every article page.

Guides are different

The guides section is the site's second content type and follows a different process from the automated news coverage above. Guides are written deliberately — drafted with AI assistance, grounded in this site's own data and documented behaviour, and maintained over time (each guide shows when it was last updated). They do not come from the ingestion pipeline, are not tied to a single source item, and are reviewed when the facts they describe change. The same honesty rules apply: no invented identifiers, no fabricated statistics, and corrections handled as below.

Sources

We aggregate from 16 public security sources — RSS feeds plus the CISA Known Exploited Vulnerabilities catalog. We do not have privileged access to any of them, and we do not conduct original research or malware analysis — credit for the underlying reporting belongs to these publishers:

• The Hacker News
• BleepingComputer
• SecurityWeek
• Krebs on Security
• Dark Reading
• Schneier on Security
• CrowdStrike Blog
• Google Cloud / Mandiant Threat Intelligence
• Cisco Talos
• Palo Alto Unit 42
• SANS Internet Storm Center
• Google Project Zero
• Recorded Future
• iTnews
• Cloudflare Blog
• CISA Known Exploited Vulnerabilities (KEV) Catalog

What we do not do

• We do not claim original reporting. Every article points at its source.
• We do not publish exploit code or weaponised proof-of-concept material.
• We do not let sponsorship influence coverage. Sponsored articles are labelled Sponsored; see the Terms of Use.

Known limitations

Language models can misread nuance, over-state confidence, or conflate similar vulnerabilities. Severity ratings are the model's assessment against a published rubric, not a vendor CVSS score unless one is explicitly cited. Because models reliably inflate severity, our pipeline does not take that rating at face value: a deterministic check downgrades a rating on three rungs when the article shows no supporting evidence — critical → high where no in-the-wild exploitation is described, high → medium where the same grounding is absent, and medium → low for issues that are patched and not being exploited. The rubric can only lower a rating, never raise it. Where an article and its primary source disagree, the primary source is correct.

Corrections

If you find an inaccuracy, email corrections@runtimerebel.com with the article URL and what is wrong. We correct or unpublish demonstrably inaccurate articles. Security researchers and vendors who want a mischaracterisation of their product or disclosure fixed will be prioritised.

For anything else, see Contact.