Authoritative security facts retain their source and observation date. CVSS, EPSS, KEV membership, confirmed exploitation, and public proof of concept status remain separate claims.
Automation may summarize validated evidence. It cannot create or overwrite vulnerability identifiers, scores, affected versions, fixed versions, exploitation claims, or source URLs.