Sources and how we cite them
Every independent review, audit and survey cited on InstallShelf, with the rules we follow for paraphrasing and linking to them.
A recommendation is only as useful as the evidence behind it. This page lists every outside publication cited on InstallShelf, says what kind of source it is, and sets out the rules we follow when we use one. Every link opens the original so you can check us.
The distinction that matters is between facts and judgement. Platform, licence, price and publisher links come from our directory data. A review, audit or survey is paraphrased here with its publisher named. The decision about whether to install something is ours, and we say so on every page.
How we cite
- We summarise independent reviews in our own words, name the organisation, give the year, and link to the original. We do not paste review text, star ratings, score tables or charts.
- Where a testing lab restricts reuse of its published results, we describe the kind of test it runs and link to the report rather than reproducing its numbers. AV-Comparatives is one such lab, and its 2025 report is cited that way.
- A source is only used where a reader can check it themselves. Scraped roundups, reprints and AI-generated 'reviews' are not sources, so they are not cited here even when they rank highly in a search.
- A citation supports a fact or a caveat. It never substitutes for our own recommendation: the decision, the trade-off and the 'when to skip it' line are written here, and they stay ours even when we disagree with the reviewer.
- We do not run benchmarks or lab tests. Where a page quotes a number from a published survey, the survey and its sample size are named on the same page.
Sources used on this site
22 sources are cited across 28 pages that carry a named source. A page with no first-party source we trust simply has no citation section; we do not fill the gap with an aggregator or a generated roundup.
| Publication | Organisation | What it covers |
|---|---|---|
| Stack Overflow Developer Survey 2025 ↗ Developer survey | Stack Overflow 2025 | Over 49,000 respondents in 177 countries. |
| Pentest Report: Bitwarden Password Manager 11.2018 ↗ Source code audit and penetration test | Cure53 2018 | White-box review of the core app, browser extension, desktop app, web app and cryptographic design. |
| Compliance, Audits and Certifications ↗ Publisher's audit index | Bitwarden Ongoing | A dated list of third-party assessments from 2018 onward, with links to each report. |
| A Formal Security Analysis of the Signal Messaging Protocol ↗ Academic cryptanalysis | Cohn-Gordon, Cremers, Dowling, Garratt, Stebila (IACR ePrint / IEEE EuroS&P) 2016, revised 2019 | Formal model of the X3DH key agreement and Double Ratchet; published at IEEE EuroS&P 2017. |
| The best Windows antivirus software for home users (Nov-Dec 2025) ↗ Independent lab test | AV-TEST Institute 2025 | Fifteen home-user security products on Windows 11, scored for protection, performance and usability. |
| Real-World Protection Test, July-October 2025 ↗ Independent lab test | AV-Comparatives 2025 | 428 live malicious URL test cases against current consumer security products on Windows 11. |
| ZDI-25-949 / ZDI-25-950 advisories (CVE-2025-11001, CVE-2025-11002) ↗ Vulnerability disclosure | Trend Micro Zero Day Initiative 2025 | Directory traversal in the handling of symbolic links inside ZIP archives; fixed in 7-Zip 25.00. |
| 7-Zip version history ↗ Publisher's changelog | 7-Zip / Igor Pavlov Ongoing | Release-by-release record of changes and security fixes. |
| BSI security analysis of VeraCrypt (Fraunhofer SIT) ↗ Government-commissioned security analysis | German Federal Office for Information Security (BSI) / Fraunhofer SIT 2020 | Independent review of the encryption software, published after the analysis was shared with the project. |
| Cover Your Tracks ↗ Reader-run browser test | Electronic Frontier Foundation Ongoing | Tests how well a browser blocks trackers and how distinctive its fingerprint is. |
| Best open source software of 2025 ↗ Editorial product roundup | TechRadar 2025 | Category-by-category picks for free desktop software, with stated pros and cons. |
| GIMP review ↗ Editorial product review | TechRadar 2025 | Hands-on review of the free raster editor, including its learning curve. |
| GIMP review and Readers' Choice 2025 survey ↗ Editorial review and reader survey | PCMag 2025 | A scored review plus a reader survey of free photo-editing software. |
| Audacity review ↗ Editorial product review | PCMag 2025 | Hands-on review of the current Audacity release on a specified test machine. |
| Obsidian review ↗ Editorial product review | PCMag 2025 | Hands-on review covering local storage, plugins, setup effort and the lack of collaboration. |
| Joplin review ↗ Editorial product review | PCMag 2025 | Hands-on review of local-first notes, sync options and plugin-dependent extras. |
| HandBrake review ↗ Editorial product review | TechRadar 2025 | Hands-on review of the video transcoder, including preset and documentation advice. |
| Best free screen recorder of 2025 ↗ Comparative product roundup | TechRadar 2025 | Tested free capture tools, with OBS Studio first and ShareX second. |
| Best animation software of 2025 ↗ Editorial product roundup | TechRadar 2025 | Professional animation tools compared, with Blender picked as the best free option. |
| Is the new WireGuard protocol secure? ↗ Explainer with independent reporting | Tom's Guide 2025 | Explains the protocol's small codebase, its 2020 third-party audit, and a privacy caveat about assigned IP addresses. |
| WireGuard project documentation ↗ Publisher documentation | WireGuard project Ongoing | Protocol description, installation instructions and whitepaper. |
| Tailscale is officially SOC 2 compliant ↗ Publisher security disclosure | Tailscale Publisher disclosure | Describes an independent SOC 2 Type I audit, the firm behind its security programme, and the claim that private keys never leave a device. |
What we still do not do
- We do not run benchmarks, lab tests or hands-on performance measurements, and no page here implies otherwise.
- We do not host, mirror or reupload installers. Every download link goes to the publisher's own website.
- We do not accept payment for a placement, a ranking or a recommendation. See the About page for the full editorial policy.
Corrections
If a source has moved, a report has been superseded, or we have misread one, tell us. Corrections are made to the page and, where the mistake is material, noted on this one.
How to read this page. How to read this page. Platform, licence and publisher details come from our directory data. Where an independent review, audit or survey is mentioned, it is summarised in our own words with the source named and linked; our /sources page sets out that policy. The recommendation, the trade-offs and every 'skip it if' line are our editorial judgement. We do not run benchmarks, publish measured performance figures or host installers, and every download link goes to the publisher's own site. If a detail is out of date, our About page explains how to tell us.