When two sources disagree, act on the safer reading for any step that is cheap and reversible, note the conflict in your ticket, and ask which source is closest to the facts. Then set a time to look again. Do not pick a winner by tone or popularity.
Disagreement is normal early on
In the first hours of an incident, reports differ for ordinary reasons. Writers see different parts of the problem. One may list versions from a first guess. Another may have newer information. Some are simply wrong.
The calm move is to treat disagreement as a sign that the facts are still forming, not as a puzzle to solve by instinct.
Step 1: identify what exactly differs
Write the disagreement as one precise question. "Source A says version 4.2 is affected, source B says only 4.3 and later." Vague disagreement leads to vague decisions. A precise question can be checked.
Step 2: rank the sources by closeness
Ask of each source: how close is it to the facts?
- The maintainer, vendor or registry that owns the thing is usually closest.
- A researcher who analyzed the code and shows their working is next.
- A news summary or social post repeating either is furthest away.
Closeness is not infallibility. Owners can be slow or incomplete. But the owner is where corrections will first appear. Our post on primary versus secondary sources goes deeper on this.
Step 3: test it yourself when you can
Some disagreements can be settled by your own check. If one source says version 4.2 is affected, you can look at what 4.2 contains, or diff it against the prior version. See the post on diffing a suspicious release. A result you produced yourself beats either report.
Step 4: take the safer reading for cheap, reversible steps
Where the two readings lead to different actions, ask what each costs.
| Action | Cost | Take the safer reading? |
|---|---|---|
| Pause an auto update for one package | Low, reversible | Yes |
| Pin to a version both sources call safe | Low, reversible | Yes |
| Rotate credentials | Medium, hard to undo in some systems | Only if exposure looks plausible |
| Announce to customers | High, public | Wait for confirmation |
The point is to be proportionate. Cheap and reversible steps should not wait for certainty. Expensive or public steps should.
Step 5: log it and set a recheck
Record both sources with links and the time you read them, your reading, who decided and why, and a time to look again. Archive the pages as described in the post on archiving a write-up.
When one source corrects itself or the other catches up, update the ticket. A visible trail of changing facts reads as competence, not indecision.
What not to do
Do not repost the more dramatic version. Do not tell customers or the public which source is wrong. Do not attribute cause or blame before the owner has said so. If you need to say something, say what you know, what you do not know yet, and when you will update.
A worked example
Imagine that at 10:15 UTC you see two reports about the same compromised library. Report A, from the maintainer, says versions 3.1.0 through 3.1.2 are affected. Report B, a widely shared summary, says only 3.1.2 is affected and that 3.1.0 and 3.1.1 are safe. Your services use 3.1.1.
Here is how the five steps play out.
- The question. Is 3.1.1 affected? Report A says yes, Report B says no.
- Closeness. Report A is from the owner. Report B is a summary that does not link its evidence. A is closer.
- Your own test. You download 3.1.0, 3.1.1 and 3.0.9 and diff them. The install script that the maintainer describes appears in 3.1.1 as well as 3.1.2. That agrees with Report A.
- Proportion. Pinning back to 3.0.9 is cheap and reversible, so you do it now. Rotating credentials is more expensive, so you wait until you know whether any build installed 3.1.1.
- Log. You record both reports, the diff result and your reasoning, and set a recheck for 13:00.
By 10:45 you have acted on the safer reading, with evidence that the safer reading was right. You have not told anyone that Report B was wrong in public. You have simply written down that the primary source and your test agree.
Five patterns behind most disagreements
| Pattern | What is happening | What helps |
|---|---|---|
| Different version ranges | One source uses a first guess, another has newer data | Ask which was updated last |
| Different meaning of affected | One means shipped the bad code, another means could be exploited | Ask what each source means by the word |
| Different scope | One covers one package, another the whole project | Check the name and ecosystem in each |
| Time difference | One was written before a correction | Compare timestamps |
| Repost errors | A summary repeated a typo | Return to the primary source |
Most conflicts fall into one of these, and spotting which one is often enough to settle the question.
When the primary source is silent
Sometimes the owner has said nothing yet, so you have two secondary sources and no referee. Then lean on what you can test yourself and on the cheap safe actions, and say plainly in your note that the owner has not yet confirmed. Set a short recheck interval, because silence from an owner often ends within hours.
Talking to colleagues while it is unresolved
People hate ambiguity and fill it with whatever is loudest. Give them a simple structure: what the two reports say, what you have verified, what you are doing meanwhile, and when you will update. The three line status note fits this well. Resist the pull to choose the more reassuring reading, and equally the more alarming one.
After it settles
When the dust clears, add one line to the ticket describing how the disagreement was resolved and which source turned out to be closest. Over time this builds a private sense of which sources in your world tend to be fast and accurate, which is more valuable than any generic ranking.
Try it yourself
Click through it at your own pace, or open it full screen. Use it to practice judging how exposed you are, which is the question both reports are really about.
Quick check
Should I wait until the sources agree before doing anything?
No. Take cheap, reversible steps on the safer reading now, and hold expensive or public steps until the facts firm up.
Which source should I trust more?
Usually the one closest to the facts, such as the maintainer or registry, but check it against your own evidence where you can.
What if both sources are secondary and the owner is silent?
Rely on your own tests and on cheap, reversible steps, state in your note that the owner has not confirmed, and recheck within hours.
Last reviewed: 19 October 2026.
