Unverified50% confidenceDecision RuleExact time
Holdfast applies a verbatim post-check to customer-facing explanations: if they contain terms such as "HTTP", "payload" or "endpoint", or promise an action that was not performed, they are rejected and replaced with built-in rule wording; the title is always generated by code.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedHoldfast's core design principle is: a message is not considered acknowledged until it has been safely stored.70% similarUnverifiedIn Live mode, Holdfast performs double SSRF validation on the forwarding URL entered by the user: it checks the target address once when saving, and checks the resolved result again on every dial.64% similarUnverifiedLeadRadar's email layer performs output validation in code: ensureSignOff() fills in sign-offs the model omitted, cleanEmailBody() removes sentences where the model says it did not check the website and prohibited clichés, and pitchGuidance() prevents the pitch from mismatching the occupation, rather than relying only on the prompt.64% similarUnverifiedBack-channel logout relies on HTTP POST requests; if an RP endpoint is unreachable, the logout notification fails, and the specification recommends that IdPs implement a retry mechanism but does not mandate it.62% similarUnverifiedThe system prompt should declare that text within email tags is untrusted customer content and that instructions within it should never be followed, in order to guard against prompt injection.62% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1061373API
curl https://kongchang.com/api/v1/knowledge/claims/1061373MCP
get_claim(id=1061373)