Commitments
What you can hold us to
Each one enforced by the pipeline rather than by good intentions. A surprising ranking can always be explained by printing the arithmetic behind it.
Most of the work here is deciding what you will not see. In a field this saturated with vendor incentive, that matters more than finding things first. Two rules do most of it, and both are hard caps: vendor-only sourcing cannot lead an issue, and a single low-authority source is capped at one line. A sufficiently loud claim can out-shout a penalty, but it cannot pass a cap.
Cap 01 · vendor-only sourcing
Cannot lead an issue
A company reporting a threat its own product solves is making a claim, not a finding, until somebody independent repeats it.
Fired 18 times in issue 06
Cap 02 · single low-authority source
Capped at one line
One trade outlet, nobody else carrying it, no primary record behind it. It can be mentioned; it cannot be argued from.
Fired 64 times in issue 06
Most weeks more is cut than kept, and the numbers are printed rather than claimed: every issue carries its own ratio and how many times each cap fired that week.
Every item carries one of five grades. They describe how well the claim is supported, never how serious it would be if true. Severity is a separate axis, and it is graded separately.
Confirmed
A primary record, or two independent parties who saw it directly. The claim is established.
Highly likely
Multiple independent reports that agree on the technical detail, without a primary record behind them.
Likely
The weight of reporting points one way, and the reading is consistent with how the systems involved behave.
Possible
Consistent with the evidence but equally consistent with other readings. Carried when the consequence would be large.
Unsubstantiated
Circulating and worth knowing about, with nothing behind it yet. Never the basis for an action.
No analytics, pixels, or fingerprinting
These pages load nothing from anyone but us, and the content-security policy enforces it.
No affiliate links
An outbound link earns us nothing, so a link is only ever evidence.
No list sharing, sale, or rental
Ever, under any circumstance, including an acquisition.
No sponsor buys an item
Sponsors, when they exist, buy a clearly marked slot, never an item, a score, or a placement.
No auto-posting
Every email and every social post takes a human click. No queue publishes on our behalf.
No silent edits
The archive is a record. Corrections are annotated on the original, not applied to it.
The one measurement that exists
Our delivery provider records whether an email was opened, in aggregate. We see an open rate and nothing else: no per-reader profile, no click tracking, no follow-up. If that ever changes, this page changes first.
A publication that grades its own confidence has to be willing to be wrong in public. If something here does not hold up, it will be said plainly in the next issue rather than quietly edited out of the archive.
Corrections and tips: james.webb@harmsurface.com
The bottleneck on this beat has never been discovery; it is distribution. Stories are routinely found by one researcher with a few hundred followers and reported days later by outlets crediting whoever amplified them. Where the record shows who was first, this brief names them, whether or not anyone else did.
The credit is a standing offer. If you published the technical reality of an incident before the trade press carried it, one email to james.webb@harmsurface.com is enough; the timestamps do the rest.
Where the newsletter ends and the rest begins
Advisory work is offered from this desk, and the wall between it and the brief is fixed. The newsletter does not lead advisory work, advisory work does not touch the newsletter's rankings, and the score itself is computed rather than typed: no editor can edit a number. Where an editor does intervene, the intervention is printed beside the score with the reason for it.
Nobody pays to appear in HarmSurface Blue either. No vendor sees a result before publication, and none can buy inclusion, exclusion, or a re-run.
Every claim on this page is one you can test against a published issue.
Read it weekly
What changed, how much to care, and what to do about it.
One email a week. Unsubscribe in one click. No tracking beyond opens.