· ReadyStack
Worked example
Real numbers from this tool, line by line.
Six dead citations in one 57-line security page — that is what comes back for a Sphinx maintainer or compliance writer at an EU or US software vendor whose docs/security.rst has not been re-read since 2024:
L11 ISO/IEC 27001:2013 is a withdrawn edition; ISO/IEC 27001:2022 replaced it, and certificates against the 2013 edition stopped being valid at the IAF transition deadline [dead since 2025-10-31] L21 PCI DSS v3.2.1 was retired. Assessments must be done against PCI DSS v4.0.1 [dead since 2024-03-31] L28 FIPS 140-2 is closed: every remaining certificate moves to the CMVP Historical List. Cite FIPS 140-3 [effective 2026-09-21] L35 NIST SP 800-53 Rev. 4 was withdrawn. Cite control identifiers from Rev. 5 [dead since 2021-09-23] L46 The EU-US Privacy Shield was invalidated in Schrems II. Transfers now rely on the EU-U.S. Data Privacy Framework adequacy decision of 10 July 2023 [dead since 2020-07-16] L48 The pre-2021 Standard Contractual Clauses could not be relied on after the repapering deadline. Cite the SCCs in (EU) 2021/914 [dead since 2022-12-27]
Those six are the worst of it, not all of it. The whole run: 30 findings — 23 dead citations, 6 warnings, 1 note — out of 44 rules.
The page nobody re-reads
Every project that sells to anyone has one: docs/security.rst, SECURITY.md, or a trust page. It is written in a hurry, the week a procurement team asks, and then it sits there. The code around it is linted on every commit. The page is not, because nothing in the toolchain knows a sentence can expire.
The six above are only the headline. On the same page the Cybersecurity Framework 1.1 reference is stale — CSF 2.0 superseded it on 2024-02-26 — and so is the NIS Directive, repealed on 2024-10-18.
One of the six has not happened yet at the time of writing: every remaining FIPS 140-2 certificate moves to the CMVP Historical List on 2026-09-21. If your hardware security module paragraph says "validated to FIPS 140-2 Level 3", it has a date on which it stops being a reassurance and becomes a finding.
Where a chatbot fails
Ask a model to review your compliance page and it will hand back prose that cites ISO 27001:2013 — the corpus it learned from is full of pages written when 27001:2013 was correct. The failure mode is not refusal; it is confident agreement in the same stale vocabulary. Editions, revision numbers and repeal dates sit in the training data in both forms.
Why grep does not cover it either
reStructuredText is hard-wrapped. In that 57-line page, 3 of the 30 findings are citations the wrapper split across a line break: "NIST / Cybersecurity Framework 1.1", "EU Data / Protection Directive" and "Article 29 Working / Party". A line-oriented search walks past all three. Stale Standard Citation Lint re-scans every line boundary and reports only matches that genuinely span it.
The other half is dates. Grep finds the string FIPS 140-2; it cannot tell you the string has a deadline attached, and it cannot change its answer tomorrow. This engine takes the date you run it on. Run the page on 2026-09-14 and the FIPS finding reads "effective 2026-09-21 — 7 days from now"; run the identical file on 2026-09-30 and the same finding reads "dead since 2026-09-21 — 9 days ago".
What the free part does
It checks the document open in your editor, or one you paste into the browser page. All 44 rules, every finding, every replacement, every date. No key, no cap, no watermark. One document checked is one finished.
The licensed part is a different job, not a larger portion of the same one: sweep every .rst, .md and .txt in the workspace and write a dated STALE-CITATIONS.md, file by file, to attach to a security questionnaire or hand to an auditor. $29 once, one licence key per person or team seat. GRC consultants bill $150-$300 an hour for documentation review, and a dense compliance page rarely takes under an hour.
15 seconds — what it actually does
Questions people ask
What does Stale Standard Citation Lint actually do?
It reads a reStructuredText, Markdown or plain text document and flags every standard edition, framework version and legal instrument you cite that has been superseded, withdrawn or repealed. Each finding names the replacement and the date the old one died. It ships 44 rules; the 57-line sample page returns 30 findings — 23 dead citations, 6 warnings, 1 note.
Who is this for?
Maintainers of open source projects with a Sphinx security page, SaaS teams who answer customer security questionnaires, and compliance writers who keep an ISO 27001 statement of applicability or a trust page in Markdown. If your documentation is reviewed by an auditor or a procurement team, a stale citation is their first finding.
Why will grep or a chatbot not do this?
Grep finds a string you already suspected; it cannot tell you that PCI DSS v3.2.1 was retired on 2024-03-31, and it misses citations that reStructuredText wrapped across a line break. In the 57-line sample page shipped with the extension, 30 findings come back and 3 of them are wrapped that way. A chatbot is trained on the corpus that wrote the stale citations in the first place.
What is free and what needs a licence?
Checking the document open in your editor is free and complete: all 44 rules, every finding, every replacement date, no key and no limit on how often you run it. The licence adds a different job, not more of the same one. It sweeps the whole workspace and writes a dated STALE-CITATIONS.md report, file by file, that you can hand to somebody else.
What would this cost done by a person?
GRC consultants bill $150 to $300 an hour for documentation review, and one dense compliance page rarely takes less than an hour to check against current editions. The licence is $29 once. The point is not only the money: a person reads the page the day you ask, and the standards move afterwards.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Standards Citation Lint - outdated ISO, NIST and RFC referen checks the file you open against 44 rules from a rule set dated 2026-09-20, and points at the exact line. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.