Editorial Policy

Effective September 29, 2026

This policy describes how Devence Lab, Inc. ("Devence Lab") researches, writes, sources, reviews, corrects, and updates the work it publishes. We publish it because research that asks to be cited should be transparent about how it is made.

It should be read with our Research and AI Disclaimer, which sets out the limits on relying on our work.

1. What we publish

Articles are long-form engineering research: an argument developed at length, supported by cited evidence, usually reporting our own analysis or reproduction of published results.

Insights are shorter reported pieces on a development in AI security, agentic systems, compute, regulation, or model releases. An insight states what happened, what is actually new about it, and what follows for someone building or defending a system.

Both are written by the Devence Lab research team. We do not publish sponsored content, advertorial, guest posts, or syndicated material.

2. Sourcing

We prefer primary sources: the paper, the specification, the advisory, the release note, the regulation, the vendor's own documentation. Where we rely on a secondary report, we say so and link to it.

Every factual claim that is not self-evident is attributable to a source a reader can check. Articles carry a numbered reference list with the full citation and a link to each primary source. The same references are published as structured schema.org citations so that a machine can read them, and every piece is published as clean Markdown alongside the HTML for the same reason.

We do not cite a source we have not read. Where a source is paywalled, we say so. Where we cannot verify a claim, we either omit it or mark it explicitly as unverified and attribute it.

3. Independence

We have no advertisers and we sell no placement. No third party pays for coverage, reviews copy before publication, or has a right of approval over what we publish.

Conflicts of interest. Where we write about a company we have a commercial relationship with, an investor in us, a customer, a partner, or a company in which a team member holds a material interest, we disclose that relationship prominently in the piece. Where a conflict is severe enough that disclosure would not cure it, we do not publish.

Vendors. We describe a product as we found it, on the date stated, from publicly available material or our own testing. We give a vendor an opportunity to comment on a material factual claim about its product before publication where practicable, and we say in the piece whether they responded.

4. Review before publication

Every piece is reviewed before publication for:

• factual accuracy — each claim checked against its cited source;
• citation integrity — every reference resolved and confirmed to say what we say it says;
• numerical accuracy — every figure traced to its stated methodology, configuration, version, and date;
• fair characterisation — of other people's work, findings, and products;
• dual-use judgement — see Section 6; and
• legal risk — defamation, intellectual property, and confidentiality.

Review is carried out by a person, and a named person is accountable for every published piece. Every citation is verified against its primary source and every quantitative claim is traced to its stated methodology before publication, whatever tools were used to prepare the draft.

5. Opinion and uncertainty

Our research contains analysis and judgement, and we state it as such. We distinguish in the text between what is established, what is contested, what is our inference, and what is speculation.

We do not manufacture false balance: where the evidence is one-sided, we say so. Equally, we do not present a contested question as settled. Where we are uncertain, we say we are uncertain and explain why.

Opinions and interpretations may change as evidence accumulates. A position taken in an earlier piece is not a commitment to hold it.

6. Dual-use material

We write about attack techniques, exploitation paths, and the limits of defensive controls, because a defence cannot be evaluated without describing what it defends against.

Our test for publishing such detail is whether it materially helps a defender understand and mitigate a risk, weighed against the marginal uplift it gives an attacker who does not already have the capability. Where detail fails that test, we describe the mechanism without providing a working path to abuse it.

Where we identify a previously unreported vulnerability in a third party's product, we follow coordinated disclosure: we report it to the vendor, allow a reasonable remediation period, and publish afterwards. We publish regardless of whether the vendor fixes it, once the period has elapsed, because a risk that is not disclosed cannot be defended against.

Use of this material is governed by our Acceptable Use Policy.

7. Corrections

We correct our mistakes, and we do so visibly.

We do not silently alter a substantive claim after publication. We do not remove a piece to avoid embarrassment. A URL we have published stays resolvable: if it must change, we redirect it permanently.

To request a correction, write to contact@devencelab.com with the piece, the passage, what you believe is wrong, and the evidence. We respond to every good-faith correction request, and we say so publicly when we were wrong.

8. Updates and currency

Every piece carries its publication date, and our sitemap and feeds carry the last-modified date. Where we substantively update a piece, we date the update.

We do not restamp unchanged pieces with a current date. A freshness signal that does not correspond to a change is a signal readers and search engines learn to distrust.

We do not undertake to keep published work current. In a field that moves this quickly, a piece should be read as a record of what was true at its date. See Section 4 of our Research and AI Disclaimer.

9. External links

External links are provided for reference. A link is not an endorsement of the linked site, its operator, its content, its security, or its privacy practices. We do not control third-party sites and are not responsible for them.

We link to primary sources wherever possible, including where we disagree with them, so that you can read the material and form your own view.

10. Anonymous sources

We prefer named, attributable sources. Where we grant anonymity — which we do rarely, and only where a source faces a genuine risk from being named — we say in the piece that we have done so and why, we verify the information independently before publishing, and we describe the source's position precisely enough for you to weigh their vantage point.

11. Reader contact