Unverified50% confidenceDecision RuleExact time
Data should be desensitized before writing the prompt, real credentials should be placed in a local env file, and pushing should be refused when suspected key patterns are detected.
1
Sources
50%
Confidence
Long-term
Relevance
10/13/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedWriting keys to a .env file and letting the Agent read environment variables directly carries a credential-leakage risk, because the Agent holds plaintext credentials throughout the entire session and they could be exposed via prompt injection or accidentally written to logs.71% similarUnverifiedManaging API keys with a .env file rather than hardcoding them is an engineering security best practice that prevents keys from being committed to a Git repository along with the code, causing leakage.70% similarUnverifiedpre-commit钩子机制可在代码提交前自动运行密钥扫描工具（如detect-secrets、gitleaks）拦截含高熵字符串的提交69% similarUnverifiedData in the system Keychain is encrypted at rest at the system level and can only be read by authorized processes of the current user, making the use of Keychain an industry-recommended security practice.68% similarVerifiedIn BYOK mode, API keys are stored in plaintext in local configuration files, posing a security risk of key leakage67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1014521API
curl https://kongchang.com/api/v1/knowledge/claims/1014521MCP
get_claim(id=1014521)