Primary evidence
Prefer direct records for events and original publications for research findings. Official statements are attributed as statements from their issuer.
Secondary sources
Use reporting and analysis to explain context. Do not convert a secondary interpretation into an official finding.
Citation maintenance
Retain stable source URLs and review links when updating a case. If evidence changes, revise the claim and record a substantive correction.
Give each source a job
A source should support a particular claim. A format specification can explain what a file represents; it cannot establish what an attacker obtained in a separate incident. A company notice can describe its disclosed findings; it does not necessarily establish every downstream consequence.
Place the source near the claim it supports and explain its role where that is not obvious. If the source only provides background, label it accordingly. This helps readers decide whether the evidence is sufficient instead of having to infer support from the length of a reference list.