Unverified50% confidenceDecision RuleExact time
All external inputs should be treated as untrusted; tokens, signatures, and identity claims must be independently verified on the server side rather than taken at face value.
1
Sources
50%
Confidence
Long-term
Relevance
10/2/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedTo counter forged government requests, the authenticity of the sending agency should be independently verified through official public channels (independent callback verification), rather than trusting the contact information in the request email.70% similarUnverifiedAny user-controlled input must be strictly validated at trust boundaries, especially on critical paths involving authentication and access control.69% similarUnverifiedSignature verification must not only check the signature value itself, but must also enforce a locked list of allowed algorithms, rather than trusting the algorithm declared in the token header.69% similarUnverified任何将数据发送到组织外部的操作都应默认需要人工确认，因为数据离开可控边界便无法收回67% similarUnverifiedServer-side authoritative validation ensures results cannot be forged, but sacrifices some accessibility.67% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/967765API
curl https://kongchang.com/api/v1/knowledge/claims/967765MCP
get_claim(id=967765)