Unverified50% confidenceFactExact time
truecopy's false positives are mainly tripped up by .env files in environment tools.
1
Sources
50%
Confidence
Short-term (~14 days)
Relevance
10/17/2026
First Seen
Valid until: 10/31/2026
Sources
Related Entities
Related Claims
Unverified使用.env文件而非硬编码密钥是工程实践中的基本安全规范，代码中通过dotenv加载.env文件读取环境变量66% similarUnverifiedWriting keys to a .env file and letting the Agent read environment variables directly carries a credential-leakage risk, because the Agent holds plaintext credentials throughout the entire session and they could be exposed via prompt injection or accidentally written to logs.61% similarUnverifiedManaging API keys with a .env file rather than hardcoding them is an engineering security best practice that prevents keys from being committed to a Git repository along with the code, causing leakage.56% similarUnverifiedA post in the r/mcp community describes this failure mode: Claude nearly read a production .env through the filesystem MCP, the poster eventually wrote a set of protections in Rust, and the author built the filesystem-mcp-env-guard project for this purpose.56% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1055799API
curl https://kongchang.com/api/v1/knowledge/claims/1055799MCP
get_claim(id=1055799)