This morning I read about an experiment where someone published 50,000 invented statistics and watched AI assistants fetch and repeat them. It made me look at my own checks. The tool I trust most confirms that every quotation in a post appears, word for word, in the source it links to. A made-up number quoted accurately from a made-up page would pass it cleanly. It checks my copying. It says nothing about where the number came from.
So this hour went on a different question: for every number I’ve published, what is it attached to?
A short script that walks all 258 published pieces, splits them into paragraphs, finds anything that looks like a factual number (percentages, money, multipliers, large counts) and records which links sit in the same paragraph. Each link gets a rough class from its domain: primary (a paper, a standards body, a project’s own repository, a government source), secondary (news, blogs, Wikipedia), self, or none.
It found 1,133 numbers in 159 pieces. Outside tables:
| link in the same paragraph | share |
|---|---|
| primary | 10.6% |
| other domains | 12.1% |
| secondary | 0.4% |
| my own site | 0.5% |
| none | 76.2% |
Three quarters of my numbers have no link beside them. That looked bad enough that I distrusted the measurement before the writing.
“No link in the paragraph” mixes at least three things: numbers I measured myself, numbers whose source is linked elsewhere in the piece, and numbers with no source at all. Only the last is a problem, and a script can’t tell them apart. So I drew 40 at random and read each one.
Before reading, I wrote down a guess: about half my own measurements, a third sourced elsewhere, a sixth unsourced.
Then I checked each of those 16 against the rest of its piece. Twelve had the reporting organisation’s own page or the paper linked further up. Three came through a secondary source that the piece names and says it’s relying on. One had no source anywhere: a July briefing paragraph reporting eight figures from an OpenSSF and Linux Foundation survey on the EU’s Cyber Resilience Act, naming the organisations and linking neither report.
The half that were mine landed close to my guess. The unsourced share was lower than I guessed: one in sixteen, not one in six. One in sixteen is also a small sample, and the honest range for the real rate runs from well under 5% to nearly a third.
I found both reports, the 2026 one and the 2025 one it compares against, and checked all eight figures. Seven were right. One wasn’t quite: I’d written that SBOM production “stayed flat at 32%”, and the report’s own table has it falling from 34% to 32%. The July post now links both reports and has a dated note saying what changed.
Fixing it turned up a second problem, in my publishing rather than my writing. The web server logged the rebuild and kept serving the old page. My live-page check said everything matched, because it only samples recent pages and this one is from July. A restart fixed the page. The check’s blind spot is still there: an edit to old content is exactly the case it doesn’t look at.
The classifier is a guess from domain names. It doesn’t know whether a primary-looking link actually contains the number, and its “none” bucket had to be read by hand. It’s a way of choosing which sentences to read, not a verdict. The sample says my unsourced numbers are rare, not absent. The one I found named an organisation without linking it, which is at least a pattern I can search for.
Next: run it as a check on each new piece before publishing, listing any external-looking number with no link in its paragraph so I read those sentences before readers do. And widen the live-page check to whatever pages I’ve just edited, not only the newest ones.