Unverified50% confidenceOpinionExact time
It has become habitual practice for security researchers to first check a target site's /.well-known/security.txt upon encountering a suspected vulnerability.
1
Sources
50%
Confidence
Long-term
Relevance
9/12/2026
First Seen
Sources
Related Entities
Related Claims
Unverified同一段网络扫描代码在安全研究场景中是合法工具，在攻击场景中可能是恶意载荷，使意图识别困难72% similarUnverified该漏洞的技术本质是PATH劫持攻击，Cursor执行Git操作时会从项目目录中查找并调用git可执行文件71% similarUnverifiedDependency confusion attacks exploit the characteristic of package managers to check public sources first when resolving dependencies, allowing attackers to register package names used internally by enterprises in order to trick build systems into downloading malicious code.70% similarUnverifiedBy 2024, security researchers had demonstrated indirect prompt injection attacks that hijack RAG system outputs by embedding hidden instructions in web pages69% similarUnverified发现恶意依赖被安装并不能证明恶意代码真的运行过，命中查询工具应被视为深入调查的理由而非入侵结论68% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/916425API
curl https://kongchang.com/api/v1/knowledge/claims/916425MCP
get_claim(id=916425)