Colophon

How Is It? is made

Built in San Francisco in 2026 by LunarCrush.

Type

Headlines are set in Newsreader by Production Type, a serif drawn for reading on screens, with an optical-size axis we tune for each size. Everything you tap is set in Geist; bug numbers and versions in Geist Mono, both by Vercel. All three are open source.

The mark is Newsreader's own question mark. Its dot changes with the answer: red when something is being used against people, amber when to be careful, green when a fix exists.

Editions

Paper by day. An Evening edition is in the footer.

Sources we stand on

• CISA's Known Exploited Vulnerabilities catalog, the list of bugs confirmed in real attacks.
• Cloudflare Radar's Zero Wire briefings.
• EPSS from FIRST.org, a daily estimate of attack likelihood.
• Vendor security advisories and the National Vulnerability Database.
• LunarCrush social data, to see what people are talking about.

With thanks

To the researchers, defenders and fraud fighters who publish what they find so the rest of us can stay safe, and to everyone who has ever forwarded a strange text to a family member and asked, is it real?