Unverified50% confidenceCautionExact time
对象存储等密钥信息只在本地读取，不写死在代码里，也不提交到代码仓库。
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedFull credentials should not be pasted into chat windows or hard-coded into project code; they should be stored in a keychain or written to a .env file excluded by .gitignore.67% similarUnverifiedmanagents' design of reading only metadata and not touching code content gives the helper program a very narrow permission boundary, making it difficult to steal source code even if it is maliciously invoked.64% similarUnverifiedThe tool runs entirely offline, reads only local files, and sends no data to any external services.63% similarUnverifiedAI can only see content that the user actively sends, and cannot see folders on the user's computer or read local code directly.63% similarUnverified当Agent的工具集只包含读取、搜索、联网等能力而没有写入权限时，AI无法将文件写入磁盘61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1043032API
curl https://kongchang.com/api/v1/knowledge/claims/1043032MCP
get_claim(id=1043032)