Unverified50% confidenceSolutionExact time
Sanitized logs and transcripts used to display the parts before and after `@` in URL passwords, exposing everything when the password was written as `%40`; this has been corrected.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
9/29/2026
First Seen
Valid until: 12/28/2026
Sources
Related Entities
Related Claims
Unverified将登录后的ChatGPT页面内容复制粘贴到第三方网址会暴露会话令牌，攻击者可静默刷新access_token实现账号持续控制，即使修改密码在令牌被服务器撤销前依然有效69% similarUnverified邮件转发中Received字段记录每一跳服务器信息，Return-Path字段存储退信地址，X-Forwarded-To等扩展头字段可能暴露真实收件人65% similarUnverified登录接口几乎清一色使用 POST 的根本原因是 URL 会被浏览器历史、服务器日志、网络设备记录，密码以 GET 参数出现会泄露明文凭据64% similarUnverifiedGoogle's Transparency Report shows that more than 90% of inbound Gmail messages are already transmitted using TLS encryption.61% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/960186API
curl https://kongchang.com/api/v1/knowledge/claims/960186MCP
get_claim(id=960186)