Historique des audits

Most static alerts are false positives from Markdown backticks, multilingual documentation, normal cache operations, and documented API access. Quota tokens lack explicit restrictive file permissions, appear in request URLs, and lack transport origin protections. No evidence found of malicious exfiltration intent, prompt injection, hidden command execution, or code obfuscation.

Most alerts are false positives involving Markdown backticks, Chinese documentation, ordinary indexing, and expected cache operations. Confirmed risks involve quota-token forwarding across redirects and an endpoint override that permits plaintext HTTP. No evidence found of malware, prompt injection, or unrelated credential collection.

Most flags reflect Markdown formatting, readable Chinese documentation, normal dictionary caching, and expected API configuration. Both HTTP helpers can forward quota credentials across host redirects or HTTPS downgrades, creating a conditional credential-disclosure risk. No evidence found of malicious intent, prompt injection, shell execution, or unrelated secret collection.