# Demonic Binary Security Writing & Reporting Style Guide
Version 1.0 - 2026-11-09

## Scope
Use for technical reports, research posts, incident write-ups and public security explanations. This is Demonic Binary's own publication convention, not a certification or external standard.

## Language
- Authentication identifies the principal. Authorization determines permission for the operation and object.
- A potential exposure is not a confirmed vulnerability without reproducible unsafe behavior and impact.
- Distinguish a demonstrated exploit, a controlled proof of concept and a hypothetical path.
- "Compromised" requires evidence of unauthorized control or data access.
- Encryption and device integrity do not replace server-side authorization.
- App Attest and Play Integrity are narrow integrity signals, not universal device-safety guarantees.
- Document the limits and prerequisites of each claim.

## Finding report
1. Identity: report ID, version, authorized scope and owner.
2. Claim: asset, test preconditions, observed behavior, timestamp and evidence reference.
3. Impact: validated consequences; differentiate proven vs. inferred risks.
4. Correction: enforcement point, invariants, owner and proposed changes.
5. Retest: negative-path reproduction, before/after behavior and unresolved limitations.

## Severity
Explain exposure, exploit prerequisites, permissions, affected data, compensating controls and environment. Include a scoring system only with its version and justified inputs. Never invent a CVSS score.

## Disclosures
Keep customer names, logos, system identifiers, quotes, interviews, and metrics private until the authorized representative approves the exact publication scope. Do not post personal data, secrets or sensitive payloads. Public demonstrations use synthetic data unless specifically approved.

## Technical formatting
Use exact HTTP status codes and verbs. Identify request and response boundaries. Include redacted examples, negative-path tests and reproducible steps when release is authorized. Distinguish production observations from synthetic exercises. Use UTC timestamps or explicitly specify the zone.

## Publication checklist
- Permission and redaction reviewed
- Claim and evidence matched
- Reproduction and limits described
- Dates and versions accurate
- Accessible diagrams and links checked
- Approval recorded for all third-party names, images, audio and metrics