Start at the source
Prefer the creator’s site, documentation, official repository or an explicitly identified access partner.
Record evidence
Keep version, date, URL, licence and offer so the record can be revised when the source changes.
Do not infer
A social post, demonstration or mirror is not enough to confirm a licence, price or availability.