---
title: "Editorial standards"
description: "How ShipSecurely sources, checks, updates, and removes entries, and how sponsorship is kept separate from the guides."
updated: "2026-10-14"
---

ShipSecurely publishes security guides and a tools directory for people shipping apps with AI coding tools. This page is how an entry gets in, stays in, or comes out.

## Sourcing

A guide starts from a failure mode that shows up in apps built this way: an open table, a secret in the client, a webhook that trusts its body. The steps cite the vendor's own documentation. Tool pages cite the public pricing page, docs page, or repository README that was opened for that entry. If a page did not state a price, a quota, or a license, the entry says it was not stated.

The header counts are the published catalog, not a survey of breaches. Tools are tool pages. Incidents tracked are issue guides. Fixes are the platform sections inside those guides. "New this week" counts guides and tools whose date falls in the last seven days in America/Los_Angeles. It is left off when that count is zero or would be larger than the guide count. Updated dates use that same time zone. The source names in the header are the sites those entries link to, with the most-cited names first. The [data page](/data) uses the same guides and writes down the counting method.

## Fact-checking

A claim on a tool card has to be restated from the linked source. The short price is that restatement, not a negotiated rate. Free tier is yes, no, or unknown. Checks are limited to source code, a live URL, Supabase row level security, and secrets, and only when the source says the tool does that. A dependency scanner with none of those four checks shows its category instead of a check it does not have.

Guides do not invent statistics, customer counts, or quotes. Severity is an editorial label for the guide, defined on the issues index. It is not a CVE score and not a count of attacks.

## Verification

Each tool page has a verified date, the day the public source was read. Each guide has an updated date. Those dates are the ones in the header and on the cards. A comparison table repeats figures from the tool pages and stays alphabetical. ShipSecurely is not a row in those tables.

## Delisting

An entry is corrected when the source page changes, and removed when the source no longer supports the claim or the product is gone. A platform page exists only when at least one guide covers that platform, either with a fix section for it or by naming a builder in the guide. A page such as `/fix/supabase-tables-without-rls-in-supabase` exists only for that pair. The platform chips and the guide filters count those same guides. Missing pairs are not generated.

## Sponsorship

The sponsor slot is labeled. When the week is unsold it says "Advertise here" and links to the [sponsor page](/sponsor). A paid week can show a name, a short pitch, and a link in that slot, and a "Sponsored by" line in newsletters that week. It does not change a guide, a severity, a tool card, a price, a verified date, or the order of any list. Lists are ordered by severity and title, or by category and name, or alphabetically. Money does not buy a higher place.