Unverified50% confidenceFactExact time
Curbcut stipulates that login credentials for staging links are sent only to the exact host the user pasted and never appear in reports, logs, or anywhere else.
1
Sources
50%
Confidence
Medium-term (~90 days)
Relevance
10/11/2026
First Seen
Valid until: 1/9/2027
Sources
Related Entities
Related Claims
UnverifiedCurbcut adopts a privacy-first design: the server retains only a bare count of daily scans, records no URLs, stores no visitor data, and uses no cookies.67% similarUnverifiedThe tool saves login states (cookies and login credentials) locally and does not upload them.65% similarUnverifiedCredentials themselves are not distributed with blueprint files and exist only within the user's own account, so sharing a blueprint does not expose account permissions.64% similarUnverifiedTokens must only be placed in the Authorization request header and never in the URL, as doing so would cause them to be recorded in logs and leaked in plaintext.63% similarUnverifiedChecking Preserve log in the DevTools Network panel prevents request records from being cleared during page navigation, and the Copy as cURL feature can export requests to a terminal for reproduction60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/999928API
curl https://kongchang.com/api/v1/knowledge/claims/999928MCP
get_claim(id=999928)