Provenance Record

Concise, well-organized Briefing appropriate to the category's word range. Correctly discloses in 'What We Don't Know' that Mozilla did not specify how long the key was exposed or the audit's scope.

Read Mozilla's blog snapshot directly and verified BleepingComputer's claims via WebFetch (403 blocked, no archive.org fallback). Mozilla's blog confirms the exposure quote, the affected-artifacts quote, the audit-finding quote, both key fingerprints, the Aug 5 2028 expiration, and the RPM remediation breakdown by distribution verbatim -- but the RPM breakdown is misattributed to BleepingComputer in the article (see finding), and the 'implemented safeguards to prevent similar incidents' quote doesn't match Mozilla's actual wording (see finding). BleepingComputer (verified via WebFetch) confirms the low-risk assessment quote, the manual-verification-steps quote, and the Thunderbird RPM-exemption quote verbatim.

All facts are directionally accurate; the issues found are attribution and quote-wording problems, not fabrications of the underlying events.

Approve with corrections. The article is accurate; the misattribution and quote-fidelity issue are both isolated to subordinate claims and are honestly covered by a public corrections note.