Unverified50% confidenceDecision RuleExact time
Any credentials that have passed through a chat should be treated as compromised and must be rotated, and agents should read credentials from local files ignored by .gitignore rather than printing them.
1
Sources
50%
Confidence
Long-term
Relevance
10/12/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedA stateful rule: once a session has read content resembling a secret key, that session's subsequent external outbound communication is shut down, blocking "read key then send" attacks.73% similarUnverifiedKeyboards inherently have access to all text entered by users, including passwords, private messages, and payment information, making privacy an unavoidable sensitive point for the input method category.71% similarUnverifiedSensitive information such as keys should not be transmitted via cross-session messages, because plaintext transmission does not equate to secure isolation.70% similarUnverifiedCredentials should be injected by a secrets manager, not written into prompts or source code, using least-privilege service accounts.65% similarUnverifiedIn Passkeys, the private key is stored on the user's device or in a password manager, the public key is handed to the service provider, and the private key itself never leaves the device.65% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1001845API
curl https://kongchang.com/api/v1/knowledge/claims/1001845MCP
get_claim(id=1001845)