Practice
Record the number before you repeat it
Amount, source, and date go on the card before the sentence you would say out loud.
github.com published this account (2026-10-25): GitHub published malware advisory between 2026-10-25T12:30:30Z and 2026-10-25T12:30:30Z for PyPI: fontus 0.0.1. The package most likely performs fingerprinting by exfiltrating basic information and available fonts, with no other functionality. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, expl No known-good version named. CVE pending (none assigned). Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS / Event time: 2026-10-25T12:30:30Z / Security record: GHSA-g5mh-f2v3-6p25 / Fixed release: none yet / Discovery confidence: High
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: GitHub published malware advisory between 2026-10-25T12:30:30Z and 2026-10-25T12:30:30Z for PyPI: fontus 0.0.1. The package most likely performs fingerprinting by exfiltrating basic information and available fonts, with no other functionality. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, expl No known-good version named. CVE pending (none assigned). Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS / Event time: 2026-10-25T12:30:30Z / Security record: GHSA-g5mh-f2v3-6p25 / Fixed release: none yet / Discovery confidence: High
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
Amount, source, and date go on the card before the sentence you would say out loud.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Malicious PyPI package fontus 0.0.1 (GitHub malware advisory GHSA-g5mh-f2v3-6p25).
Sources: Malicious PyPI package fontus 0.0.1 (GitHub malware advisory GHSA-g5mh-f2v3-6p25)