Quiz · 4 questions
🔑 The Handoff Is Identity-Only
A URL that carries a capability, never a path — and why both sides still check
Level 0Reel Novice
0 XP0/39 lessons0/12 achievements
0/100 XP to next level100 XP to go0% complete
Quiz
01What does the cwkashenreel:// deep link carry?
02Why would putting a file path in the deep link be a confused-deputy vulnerability?
03Ashen Reel resolves the video_id through the loopback Recall API and gets back a path. What must it still do before opening the file?
04A user drags a file from Finder onto Ashen Reel. That file URL is a real path. Does it violate the identity-only rule?
Comments 0
🔔 Reply notifications (sign in)Sign in — Please sign in to comment.
No comments yet — be the first.