Unverified50% confidenceCautionExact time
The author argues that API keys should not be sent to random third-party "JSON repair" services, nor should "almost passing" validation results be hidden.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedSystem prompts alone cannot guarantee that every output meets standard practices; connecting structured JSON asset files is the key to producing consistently standardized outputs68% similarUnverifiedThe author tried to cram parameter checking into a gateway plugin, and the plugin ended up parsing JSON in places where JSON parsing should not occur.67% similarUnverifiedAPI keys must stay on the server side, not be exposed in front-end JavaScript, and not be committed to public repositories.67% similarUnverifiedPreToolUse and PermissionRequest hooks are no longer skipped when matching fails or tool input cannot be serialized to JSON; instead, the call is directly blocked.67% similarUnverifiedUsers should not commit real API keys to code repositories, and should configure keys via environment variables.66% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1043348API
curl https://kongchang.com/api/v1/knowledge/claims/1043348MCP
get_claim(id=1043348)