KNLOV5€KNLOSB1E‡wùñp´Ô¶€fåiïòî ËÆ¥á Ž@Êïž'Ø^$ѽT0PuKîE ×5ý ¡dõ”iZÌŠ}؇›Á¬ug+ÆÝ«=ÂZÉKü«œîzœwƒ–~±`ž€KSEGîNçÕÒ0¥‚Ænv„~µå"R·Í\+ ŠË%IÉ®©˜¤ebytesY2Authn vs authz: authentication is who the caller is. Authorization is what they may do. A valid login that can read another user’s order is an authz bug, not an authn bug. Check authz on every request using the server-side principal, not a user id the client sent. For object access, the question is “does this principal own or may it read this id?†not “is this id well-formed?†401 when you do not know who they are. 403 when you know and they may not. Do not leak existence of other users’ objects if that is sensitive; some products choose 404.bidxGsha256-001a34cf42223b23b87a15f9f369e1bfa55afdc70b6142f538a0e5f4eb238828dkindechunkdmeta¦edocIdnauthn-vs-authzgheadingnAuthn vs authzmlegacyBlockIdinamespacedauthlsourceObjectxGsha256-9ba2edfa6382d580369d0a297ddc964e28043808569a79ecfc49753a50cf41a3dspan¢cend&estart¤ebytesY«Hash passwords with a memory-hard algorithm (Argon2id, scrypt, or bcrypt with a work factor you revisit). Unique salt per password. Never store reversible encryption of passwords so you can “email them their password.†On login, use a constant-time compare of the hash. Rate-limit by account and by IP. After a password change, invalidate other sessions. Do not compose your own hashing. Do not use MD5 or unsalted SHA-1.bidxGsha256-0463c93f9e1b6465b8a7b0fef6b97ca5a0e07dbe6d21febc193999976762dad9dkindfsourcedmeta£edocIdppassword-storagemlegacyBlockIdinamespacedauth¤ebytesYÍXSS is untrusted text interpreted as HTML or JavaScript. Encode on output for the context (HTML body, attribute, URL, JS). A Content-Security-Policy that disables inline scripts reduces impact. Dangerous sinks: innerHTML, document.write, href=javascript:, eval of JSONP. Markdown and rich-text need a sanitizer, not a regex. HttpOnly cookies do not stop XSS from acting as the user. They stop XSS from reading the cookie. Treat XSS as session-adjacent anyway.bidxGsha256-1b206d794523ee9c84b3e15478187ac544bb79657b2c3df87376b3df72e5a5c0dkindechunkdmeta¦edocIdcxssgheadingtCross-site scriptingmlegacyBlockIdinamespaceiinjectionlsourceObjectxGsha256-ca7159f17c86d6e6d5661c840eee9f839938bfc4ec196179a4bad48a2afc38dddspan¢cendÍestart¤ebytesY¹If your server fetches a URL the user supplied (webhooks, previews, importers), you will fetch the cloud metadata service unless you block it. Allow-list schemes (https) and hosts. Resolve DNS and block private ranges after resolve, not only on the hostname string. Do not follow redirects to a new host without re-checking. Do not pass the response back as trusted HTML. SSRF is how a “URL preview†becomes “read 169.254.169.254â€.bidxGsha256-49e769228c1d1a747011ab041c5af2fd8565d2f975ec5db8651b57e5e93c97addkindechunkdmeta¦edocIddssrfgheadingxServer-side request forgerymlegacyBlockId inamespaceiinjectionlsourceObjectxGsha256-77c3c09831702389787a0b9a1bb19cc1779d93f353cb47726e0d2ee27dbf484fdspan¢cend±estart¤ebytesXf¢lsourceDigestxGsha256-1c6e5b2a2f3f07745b30108989728a03603e7b9a5218dc8a06992b386ee39efcmsourceVersionbidxGsha256-4f2880cfed05cdbfbf9329aba767a6550456425fdc97817003dd2fc260803885dkindhmetadatadmeta¢lsourceDigestxGsha256-1c6e5b2a2f3f07745b30108989728a03603e7b9a5218dc8a06992b386ee39efcmsourceVersion¤ebytesYÏParameterized queries: pass user values as bound parameters, never concatenated into SQL. This is the control for SQL injection. ORMs that use parameters are fine; string-building a WHERE clause is not. Do not “escape quotes†by hand. Do not allow the client to send a column name or ORDER BY unless it is on a server allow-list. Command injection is the same idea: never pass unsanitized input to a shell. Prefer execFile with an argument array over sh -c.bidxGsha256-579a4af9eb9586ac0d6aff444e57ad4488d1ef12706db1542810b3c1de09a09edkindfsourcedmeta£edocIduparameterized-queriesmlegacyBlockIdinamespaceiinjection¤ebytesYâRotate a leaked secret first, then clean history. Rewriting git does not un-leak a credential that already left the laptop. Assume the value is burned. Order: revoke at the provider, issue a new secret, update the runtime config, confirm the old one fails, then consider git filter-repo if the secret is in git. Tell every clone to re-fetch. Do not paste the secret into the incident channel, a ticket, or a Knowledge Image. Hub verification will fail a kno_ or sk- looking token.bidxGsha256-5ac779fce0339f93faefc13813cf9aa4b7d3875ff1693f71ad42a4a88bd93a44dkindfsourcedmeta£edocIdtrotate-leaked-secretmlegacyBlockIdinamespacegsecrets¤ebytesYhttpOnly secure cookie: session cookies should be Secure (HTTPS only), HttpOnly (not readable from JavaScript), and SameSite=Lax or Strict. Set a short idle timeout and an absolute lifetime. Rotate the session id at login. Do not store the raw session token in a log. Do not put the session in localStorage; XSS then becomes account takeover. Prefer a server-side session or a signed, bound token. If you use JWTs in cookies, still set those flags. Access tokens in the body of every JSON response are how XSS steals sessions.bidxGsha256-5d0a3e444236e7b9133f9accadee18810ac38b46d91999e9d7673884e0d79fe5dkindechunkdmeta¦edocIdvhttponly-secure-cookiegheadingvhttpOnly secure cookiemlegacyBlockIdinamespacehsessionslsourceObjectxGsha256-78ac2859cd012e46150556334db0dcb2dbee8340f944f81a1eae9d4241b24242dspan¢cendestart¤ebytesYÏParameterized queries: pass user values as bound parameters, never concatenated into SQL. This is the control for SQL injection. ORMs that use parameters are fine; string-building a WHERE clause is not. Do not “escape quotes†by hand. Do not allow the client to send a column name or ORDER BY unless it is on a server allow-list. Command injection is the same idea: never pass unsanitized input to a shell. Prefer execFile with an argument array over sh -c.bidxGsha256-5daf91a4c35c23aa4f7cff61aca4dd250bca1c5812dfdf5102b613cdc2b07bdddkindechunkdmeta¦edocIduparameterized-queriesgheadinguParameterized queriesmlegacyBlockIdinamespaceiinjectionlsourceObjectxGsha256-579a4af9eb9586ac0d6aff444e57ad4488d1ef12706db1542810b3c1de09a09edspan¢cendËestart¤ebytesY{"version":1,"agents":[{"id":"appsec-coach","version":1,"name":"AppSec Coach","description":"Answers application-security questions from this pack. Never scans or exploits.","systemPrompt":["Answer only from retrieved evidence.","Prefer concrete controls (cookie flags, parameterized queries, hashed tokens).","Do not provide exploit payloads. Do not execute tools."],"retrievalDefaults":{"namespace":["auth","sessions","injection","secrets","headers"],"topK":5},"toolPolicy":{"mode":"deny","tools":["shell","scanner","exploit","exec"]}}]}bidxGsha256-6e600a9fb28582b75c9a83be09721b0ce6f750c54cc21751919e33b815ccd222dkindfagentsdmeta¢hencodinggjson-v4gversion¤ebytesY¹If your server fetches a URL the user supplied (webhooks, previews, importers), you will fetch the cloud metadata service unless you block it. Allow-list schemes (https) and hosts. Resolve DNS and block private ranges after resolve, not only on the hostname string. Do not follow redirects to a new host without re-checking. Do not pass the response back as trusted HTML. SSRF is how a “URL preview†becomes “read 169.254.169.254â€.bidxGsha256-77c3c09831702389787a0b9a1bb19cc1779d93f353cb47726e0d2ee27dbf484fdkindfsourcedmeta£edocIddssrfmlegacyBlockId inamespaceiinjection¤ebytesYhttpOnly secure cookie: session cookies should be Secure (HTTPS only), HttpOnly (not readable from JavaScript), and SameSite=Lax or Strict. Set a short idle timeout and an absolute lifetime. Rotate the session id at login. Do not store the raw session token in a log. Do not put the session in localStorage; XSS then becomes account takeover. Prefer a server-side session or a signed, bound token. If you use JWTs in cookies, still set those flags. Access tokens in the body of every JSON response are how XSS steals sessions.bidxGsha256-78ac2859cd012e46150556334db0dcb2dbee8340f944f81a1eae9d4241b24242dkindfsourcedmeta£edocIdvhttponly-secure-cookiemlegacyBlockIdinamespacehsessions¤ebytesYÜMinimum useful headers for a web app: Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, and HSTS on the HTTPS canonical host. Frame-ancestors in CSP replaces X-Frame-Options. Do not copy a 40-directive CSP you do not understand. Start with default-src 'self'; object-src 'none'; base-uri 'self' and add the exceptions you measure. CORS is not a security header for your own pages. It is a permission for other origins to read your API. Default deny.bidxGsha256-87cd8f983f5dfa9ded1c9f0741f4b46e8a4ba161b5c1d577289521d198e62e78dkindechunkdmeta¦edocIdpsecurity-headersgheadingwUseful security headersmlegacyBlockId inamespacegheaderslsourceObjectxGsha256-98f633fbb492d90d0a7865b622144650fdedb0c551e00bed2f1e08bf13d59e72dspan¢cendÜestart¤ebytesY­Store secrets in a manager or in environment variables injected at runtime. Do not commit them. Do not put them in client bundles. Do not log them. API tokens: store sha256(token) and compare hashes. Show the raw secret once. Prefixes (kno_, ghp_) help humans revoke the right one. Encryption keys: separate from the data they protect, rotate with a version id, and keep a decrypt path for the previous version during rotation.bidxGsha256-8ff9febf1fc88e3f582361fafb1dab81d80c0a5d07faff2eb338753bf58299b7dkindfsourcedmeta£edocIdmstore-secretsmlegacyBlockIdinamespacegsecrets¤ebytesYÜMinimum useful headers for a web app: Content-Security-Policy, X-Content-Type-Options: nosniff, Referrer-Policy, and HSTS on the HTTPS canonical host. Frame-ancestors in CSP replaces X-Frame-Options. Do not copy a 40-directive CSP you do not understand. Start with default-src 'self'; object-src 'none'; base-uri 'self' and add the exceptions you measure. CORS is not a security header for your own pages. It is a permission for other origins to read your API. Default deny.bidxGsha256-98f633fbb492d90d0a7865b622144650fdedb0c551e00bed2f1e08bf13d59e72dkindfsourcedmeta£edocIdpsecurity-headersmlegacyBlockId inamespacegheaders¤ebytesY2Authn vs authz: authentication is who the caller is. Authorization is what they may do. A valid login that can read another user’s order is an authz bug, not an authn bug. Check authz on every request using the server-side principal, not a user id the client sent. For object access, the question is “does this principal own or may it read this id?†not “is this id well-formed?†401 when you do not know who they are. 403 when you know and they may not. Do not leak existence of other users’ objects if that is sensitive; some products choose 404.bidxGsha256-9ba2edfa6382d580369d0a297ddc964e28043808569a79ecfc49753a50cf41a3dkindfsourcedmeta£edocIdnauthn-vs-authzmlegacyBlockIdinamespacedauth¤ebytesYâRotate a leaked secret first, then clean history. Rewriting git does not un-leak a credential that already left the laptop. Assume the value is burned. Order: revoke at the provider, issue a new secret, update the runtime config, confirm the old one fails, then consider git filter-repo if the secret is in git. Tell every clone to re-fetch. Do not paste the secret into the incident channel, a ticket, or a Knowledge Image. Hub verification will fail a kno_ or sk- looking token.bidxGsha256-b1967e00a7a8a2c6a802f69878893e2597e20087c097ef585ef80e322de4505edkindechunkdmeta¦edocIdtrotate-leaked-secretgheadingvRotate a leaked secretmlegacyBlockIdinamespacegsecretslsourceObjectxGsha256-5ac779fce0339f93faefc13813cf9aa4b7d3875ff1693f71ad42a4a88bd93a44dspan¢cendâestart¤ebytesY­Store secrets in a manager or in environment variables injected at runtime. Do not commit them. Do not put them in client bundles. Do not log them. API tokens: store sha256(token) and compare hashes. Show the raw secret once. Prefixes (kno_, ghp_) help humans revoke the right one. Encryption keys: separate from the data they protect, rotate with a version id, and keep a decrypt path for the previous version during rotation.bidxGsha256-b72fd2f6423e73ff055e7a8abe1440048ca56f4ba950d1e414bfc40b3b8490fcdkindechunkdmeta¦edocIdmstore-secretsgheadingtHow to store secretsmlegacyBlockIdinamespacegsecretslsourceObjectxGsha256-8ff9febf1fc88e3f582361fafb1dab81d80c0a5d07faff2eb338753bf58299b7dspan¢cend­estart¤ebytesYjIf you take a next= URL after login, allow-list hosts or only allow relative paths that start with / and do not start with //. An open redirect turns your domain into a phishing hop. Never reflect the full incoming URL in a Location header. Never send tokens in the query string of that redirect. Login CSRF plus an open redirect is a common pairing. Fix both.bidxGsha256-c721f3d89327c32ff254994183004041ed3dd7385421a619862d5dc8b24437c3dkindechunkdmeta¦edocIdmopen-redirectgheadingnOpen redirectsmlegacyBlockIdinamespacegheaderslsourceObjectxGsha256-ed5251d0cd93b81628a8c078a140de90d32dea3f71655d82a0fcf953aba3458adspan¢cendjestart¤ebytesYCSRF token: a browser logged into your site can be tricked into submitting a POST from another origin. SameSite=Lax cookies block many simple cases. State-changing POST/PUT/PATCH/DELETE still need a CSRF token or a custom request header that CORS will not add from a foreign page. The token is per session, verified server-side, not reflected in GET query strings. GET must remain safe. APIs that use Authorization: Bearer (not cookies) are not cookie-CSRF. They still need CORS that does not echo * with credentials.bidxGsha256-c79d52222b043d46698ea619e85bb9380ea5c7c4b5403bfe094b8df037199acddkindechunkdmeta¦edocIdjcsrf-tokengheadingjCSRF tokenmlegacyBlockIdinamespacehsessionslsourceObjectxGsha256-d754a7e0b4d17d3757b0f8ec3fde3c89b48ad02241c400e08d8942ab03c31166dspan¢cendestart¤ebytesYÍXSS is untrusted text interpreted as HTML or JavaScript. Encode on output for the context (HTML body, attribute, URL, JS). A Content-Security-Policy that disables inline scripts reduces impact. Dangerous sinks: innerHTML, document.write, href=javascript:, eval of JSONP. Markdown and rich-text need a sanitizer, not a regex. HttpOnly cookies do not stop XSS from acting as the user. They stop XSS from reading the cookie. Treat XSS as session-adjacent anyway.bidxGsha256-ca7159f17c86d6e6d5661c840eee9f839938bfc4ec196179a4bad48a2afc38dddkindfsourcedmeta£edocIdcxssmlegacyBlockIdinamespaceiinjection¤ebytesYCSRF token: a browser logged into your site can be tricked into submitting a POST from another origin. SameSite=Lax cookies block many simple cases. State-changing POST/PUT/PATCH/DELETE still need a CSRF token or a custom request header that CORS will not add from a foreign page. The token is per session, verified server-side, not reflected in GET query strings. GET must remain safe. APIs that use Authorization: Bearer (not cookies) are not cookie-CSRF. They still need CORS that does not echo * with credentials.bidxGsha256-d754a7e0b4d17d3757b0f8ec3fde3c89b48ad02241c400e08d8942ab03c31166dkindfsourcedmeta£edocIdjcsrf-tokenmlegacyBlockIdinamespacehsessions¤ebytesY«Hash passwords with a memory-hard algorithm (Argon2id, scrypt, or bcrypt with a work factor you revisit). Unique salt per password. Never store reversible encryption of passwords so you can “email them their password.†On login, use a constant-time compare of the hash. Rate-limit by account and by IP. After a password change, invalidate other sessions. Do not compose your own hashing. Do not use MD5 or unsalted SHA-1.bidxGsha256-ea17c6e9a9885cf614297e37855f93dca22079b8e50ac1d399ec701ccdb0009cdkindechunkdmeta¦edocIdppassword-storagegheadingpPassword storagemlegacyBlockIdinamespacedauthlsourceObjectxGsha256-0463c93f9e1b6465b8a7b0fef6b97ca5a0e07dbe6d21febc193999976762dad9dspan¢cend§estart¤ebytesYjIf you take a next= URL after login, allow-list hosts or only allow relative paths that start with / and do not start with //. An open redirect turns your domain into a phishing hop. Never reflect the full incoming URL in a Location header. Never send tokens in the query string of that redirect. Login CSRF plus an open redirect is a common pairing. Fix both.bidxGsha256-ed5251d0cd93b81628a8c078a140de90d32dea3f71655d82a0fcf953aba3458adkindfsourcedmeta£edocIdmopen-redirectmlegacyBlockIdinamespacegheaders¤ebytesY{"version":1,"nodes":[{"id":"n_06f7c12a","label":"access tokens in the body of every json response"},{"id":"n_08174a8a","label":"on a server allow-list"},{"id":"n_08df8f34","label":"not a security header for your own pages"},{"id":"n_2a6a4a96","label":"how xss steals sessions"},{"id":"n_348157d9","label":"a common pairing"},{"id":"n_4f97ba95","label":"assume the value"},{"id":"n_5538b3f1","label":"the token"},{"id":"n_59105b61","label":"per session verified server-side not reflected in get query strings"},{"id":"n_6d51ab1b","label":"fine string-building a where clause is not"},{"id":"n_71c42967","label":"what they may do"},{"id":"n_913657be","label":"authorization"},{"id":"n_943a9bbf","label":"ssrf"},{"id":"n_9bfd4807","label":"login csrf plus an open redirect"},{"id":"n_a5aea5e6","label":"orms that use parameters"},{"id":"n_ac375178","label":"the same idea never pass unsanitized input to a shell"},{"id":"n_ac96ea97","label":"command injection"},{"id":"n_c10f96e3","label":"how a url preview becomes read 169 254 169 254"},{"id":"n_d589febd","label":"xss"},{"id":"n_dd3a5119","label":"burned"},{"id":"n_e45598b4","label":"do not allow the client to send a column name or order by unless it"},{"id":"n_e90ae619","label":"untrusted text interpreted as html or javascript"},{"id":"n_ef5e7cd4","label":"cors"}],"edges":[{"id":"e_0506467d","from":"n_4f97ba95","p":"is","to":"n_dd3a5119","evidence":[5]},{"id":"e_12ea2aa8","from":"n_d589febd","p":"is","to":"n_e90ae619","evidence":[4]},{"id":"e_547d161a","from":"n_e45598b4","p":"is","to":"n_08174a8a","evidence":[3]},{"id":"e_571fdab0","from":"n_9bfd4807","p":"is","to":"n_348157d9","evidence":[8]},{"id":"e_578b73e8","from":"n_06f7c12a","p":"is","to":"n_2a6a4a96","evidence":[1]},{"id":"e_57f03850","from":"n_ac96ea97","p":"is","to":"n_ac375178","evidence":[3]},{"id":"e_589557a9","from":"n_943a9bbf","p":"is","to":"n_c10f96e3","evidence":[10]},{"id":"e_69ebc9e4","from":"n_913657be","p":"is","to":"n_71c42967","evidence":[0]},{"id":"e_81b4d640","from":"n_ef5e7cd4","p":"is","to":"n_08df8f34","evidence":[9]},{"id":"e_e0fb2bdf","from":"n_5538b3f1","p":"is","to":"n_59105b61","evidence":[2]},{"id":"e_e91439a3","from":"n_a5aea5e6","p":"is","to":"n_6d51ab1b","evidence":[3]}],"index":{"labelToId":{"access tokens in the body of every json response":"n_06f7c12a","on a server allow-list":"n_08174a8a","not a security header for your own pages":"n_08df8f34","how xss steals sessions":"n_2a6a4a96","a common pairing":"n_348157d9","assume the value":"n_4f97ba95","the token":"n_5538b3f1","per session verified server-side not reflected in get query strings":"n_59105b61","fine string-building a where clause is not":"n_6d51ab1b","what they may do":"n_71c42967","authorization":"n_913657be","ssrf":"n_943a9bbf","login csrf plus an open redirect":"n_9bfd4807","orms that use parameters":"n_a5aea5e6","the same idea never pass unsanitized input to a shell":"n_ac375178","command injection":"n_ac96ea97","how a url preview becomes read 169 254 169 254":"n_c10f96e3","xss":"n_d589febd","burned":"n_dd3a5119","do not allow the client to send a column name or order by unless it":"n_e45598b4","untrusted text interpreted as html or javascript":"n_e90ae619","cors":"n_ef5e7cd4"},"out":{"n_4f97ba95":["e_0506467d"],"n_d589febd":["e_12ea2aa8"],"n_e45598b4":["e_547d161a"],"n_9bfd4807":["e_571fdab0"],"n_06f7c12a":["e_578b73e8"],"n_ac96ea97":["e_57f03850"],"n_943a9bbf":["e_589557a9"],"n_913657be":["e_69ebc9e4"],"n_ef5e7cd4":["e_81b4d640"],"n_5538b3f1":["e_e0fb2bdf"],"n_a5aea5e6":["e_e91439a3"]},"in":{"n_dd3a5119":["e_0506467d"],"n_e90ae619":["e_12ea2aa8"],"n_08174a8a":["e_547d161a"],"n_348157d9":["e_571fdab0"],"n_2a6a4a96":["e_578b73e8"],"n_ac375178":["e_57f03850"],"n_c10f96e3":["e_589557a9"],"n_71c42967":["e_69ebc9e4"],"n_08df8f34":["e_81b4d640"],"n_59105b61":["e_e0fb2bdf"],"n_6d51ab1b":["e_e91439a3"]}}}bidxGsha256-fae5a691a261dcc7cc59f0f7a0a2b52a54e90997ae31f1eb3f721ed17a916de7dkindfclaimsdmeta¢hencodinggjson-v4gversionKSEGç6ò#õž÷d~ºÇ~ ÐÔ_wñV§Ó]æ?¨Ë®jJ˜ªeactorqknolo-v4-migratorlactorCounterbidxGsha256-2014026db734c8688529a5c6719e2a975b1217234310440664939af34af36a7fdkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-ed5251d0cd93b81628a8c078a140de90d32dea3f71655d82a0fcf953aba3458ajprovenance¡hobjectIdxGsha256-ed5251d0cd93b81628a8c078a140de90d32dea3f71655d82a0fcf953aba3458aftargetxGsha256-ed5251d0cd93b81628a8c078a140de90d32dea3f71655d82a0fcf953aba3458amtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-240505bead7651d6207b4face3dc338ff4bba93b4e34343def8c0514aa668f3cdkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-ca7159f17c86d6e6d5661c840eee9f839938bfc4ec196179a4bad48a2afc38ddjprovenance¡hobjectIdxGsha256-ca7159f17c86d6e6d5661c840eee9f839938bfc4ec196179a4bad48a2afc38ddftargetxGsha256-ca7159f17c86d6e6d5661c840eee9f839938bfc4ec196179a4bad48a2afc38ddmtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounter bidxGsha256-27fd0ccc09780294488c29be24f8b080bdab8377bb96df1ea00027abc834e7e6dkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-78ac2859cd012e46150556334db0dcb2dbee8340f944f81a1eae9d4241b24242jprovenance¡hobjectIdxGsha256-78ac2859cd012e46150556334db0dcb2dbee8340f944f81a1eae9d4241b24242ftargetxGsha256-78ac2859cd012e46150556334db0dcb2dbee8340f944f81a1eae9d4241b24242mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-2ff38d89400ea986bdb8c7bc7a944f57fb68eeb7ca2cbed826a988b563b3bb19dkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-ea17c6e9a9885cf614297e37855f93dca22079b8e50ac1d399ec701ccdb0009cjprovenance¡hobjectIdxGsha256-ea17c6e9a9885cf614297e37855f93dca22079b8e50ac1d399ec701ccdb0009cftargetxGsha256-ea17c6e9a9885cf614297e37855f93dca22079b8e50ac1d399ec701ccdb0009cmtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-313047f8a6708694d8c84772296ee47d7196e7944410686ce4144ca012f92c6adkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-5d0a3e444236e7b9133f9accadee18810ac38b46d91999e9d7673884e0d79fe5jprovenance¡hobjectIdxGsha256-5d0a3e444236e7b9133f9accadee18810ac38b46d91999e9d7673884e0d79fe5ftargetxGsha256-5d0a3e444236e7b9133f9accadee18810ac38b46d91999e9d7673884e0d79fe5mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-48fa7cc1953e1bdada130ab0f6f577d1088a3fd6d6826c1d39dd26f6ec617e6edkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-98f633fbb492d90d0a7865b622144650fdedb0c551e00bed2f1e08bf13d59e72jprovenance¡hobjectIdxGsha256-98f633fbb492d90d0a7865b622144650fdedb0c551e00bed2f1e08bf13d59e72ftargetxGsha256-98f633fbb492d90d0a7865b622144650fdedb0c551e00bed2f1e08bf13d59e72mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-5ef029d5c436ef92c18ad1287594c63aca8889b92c2fd370701d24f7356a22d7dkindlmetadata.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-4f2880cfed05cdbfbf9329aba767a6550456425fdc97817003dd2fc260803885jprovenance¡hobjectIdxGsha256-4f2880cfed05cdbfbf9329aba767a6550456425fdc97817003dd2fc260803885ftargetxGsha256-4f2880cfed05cdbfbf9329aba767a6550456425fdc97817003dd2fc260803885mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-694a0b859784fc3fd1d421c959305ca379c6072b316e7345ee30ca64b193e0a0dkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-1b206d794523ee9c84b3e15478187ac544bb79657b2c3df87376b3df72e5a5c0jprovenance¡hobjectIdxGsha256-1b206d794523ee9c84b3e15478187ac544bb79657b2c3df87376b3df72e5a5c0ftargetxGsha256-1b206d794523ee9c84b3e15478187ac544bb79657b2c3df87376b3df72e5a5c0mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounter bidxGsha256-69e901c93c14a6df27e33db3e9a9e1f4b24f6d02890893340b5fc76aec9e120cdkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-5daf91a4c35c23aa4f7cff61aca4dd250bca1c5812dfdf5102b613cdc2b07bddjprovenance¡hobjectIdxGsha256-5daf91a4c35c23aa4f7cff61aca4dd250bca1c5812dfdf5102b613cdc2b07bddftargetxGsha256-5daf91a4c35c23aa4f7cff61aca4dd250bca1c5812dfdf5102b613cdc2b07bddmtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-71010c8639d4a073ef24fff64eb88eedf0ad107d8d901498f011a6d2ec9609fbdkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-0463c93f9e1b6465b8a7b0fef6b97ca5a0e07dbe6d21febc193999976762dad9jprovenance¡hobjectIdxGsha256-0463c93f9e1b6465b8a7b0fef6b97ca5a0e07dbe6d21febc193999976762dad9ftargetxGsha256-0463c93f9e1b6465b8a7b0fef6b97ca5a0e07dbe6d21febc193999976762dad9mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-8546e8e7a90ed9182b6ce99d9751098f74bf76e57f07188d1e5ca75a555a378cdkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-d754a7e0b4d17d3757b0f8ec3fde3c89b48ad02241c400e08d8942ab03c31166jprovenance¡hobjectIdxGsha256-d754a7e0b4d17d3757b0f8ec3fde3c89b48ad02241c400e08d8942ab03c31166ftargetxGsha256-d754a7e0b4d17d3757b0f8ec3fde3c89b48ad02241c400e08d8942ab03c31166mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-895678699e8ad16961492ec9709d162350b99ce30cee1febb0c15289bb5b265adkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-b1967e00a7a8a2c6a802f69878893e2597e20087c097ef585ef80e322de4505ejprovenance¡hobjectIdxGsha256-b1967e00a7a8a2c6a802f69878893e2597e20087c097ef585ef80e322de4505eftargetxGsha256-b1967e00a7a8a2c6a802f69878893e2597e20087c097ef585ef80e322de4505emtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounter bidxGsha256-895c39b3c619a1c7034ebbf4732f5639a087a4d5ccb2e98ceeb6f1061dedb465dkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-87cd8f983f5dfa9ded1c9f0741f4b46e8a4ba161b5c1d577289521d198e62e78jprovenance¡hobjectIdxGsha256-87cd8f983f5dfa9ded1c9f0741f4b46e8a4ba161b5c1d577289521d198e62e78ftargetxGsha256-87cd8f983f5dfa9ded1c9f0741f4b46e8a4ba161b5c1d577289521d198e62e78mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-956cf7cfb1d033c294af20f14dd5bf7da1a094c1e82d2c6ec2e07df72b480667dkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-9ba2edfa6382d580369d0a297ddc964e28043808569a79ecfc49753a50cf41a3jprovenance¡hobjectIdxGsha256-9ba2edfa6382d580369d0a297ddc964e28043808569a79ecfc49753a50cf41a3ftargetxGsha256-9ba2edfa6382d580369d0a297ddc964e28043808569a79ecfc49753a50cf41a3mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-aa54c036a145926d3e1879e57ac645352d12df5ddfc83e13aa5a886805411262dkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-b72fd2f6423e73ff055e7a8abe1440048ca56f4ba950d1e414bfc40b3b8490fcjprovenance¡hobjectIdxGsha256-b72fd2f6423e73ff055e7a8abe1440048ca56f4ba950d1e414bfc40b3b8490fcftargetxGsha256-b72fd2f6423e73ff055e7a8abe1440048ca56f4ba950d1e414bfc40b3b8490fcmtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounter bidxGsha256-b84ccbc64ea813b8189a57c4b1a27f67871dd485f56025f2b7c86d9c8886c841dkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-77c3c09831702389787a0b9a1bb19cc1779d93f353cb47726e0d2ee27dbf484fjprovenance¡hobjectIdxGsha256-77c3c09831702389787a0b9a1bb19cc1779d93f353cb47726e0d2ee27dbf484fftargetxGsha256-77c3c09831702389787a0b9a1bb19cc1779d93f353cb47726e0d2ee27dbf484fmtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-bc5e14aa1dfb833890ae1d2b7dbf0c07fbd1cd93b0201eaadeb69a5499e5b2a1dkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-579a4af9eb9586ac0d6aff444e57ad4488d1ef12706db1542810b3c1de09a09ejprovenance¡hobjectIdxGsha256-579a4af9eb9586ac0d6aff444e57ad4488d1ef12706db1542810b3c1de09a09eftargetxGsha256-579a4af9eb9586ac0d6aff444e57ad4488d1ef12706db1542810b3c1de09a09emtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-c68137ab2058b2609cf2699830c7406780b64135f32e5103f3014274a4fd6dafdkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-c721f3d89327c32ff254994183004041ed3dd7385421a619862d5dc8b24437c3jprovenance¡hobjectIdxGsha256-c721f3d89327c32ff254994183004041ed3dd7385421a619862d5dc8b24437c3ftargetxGsha256-c721f3d89327c32ff254994183004041ed3dd7385421a619862d5dc8b24437c3mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-cfa6491a3fb2885b0f91ac62de4f65376a43300520044f6c8484bc178f63239cdkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-5ac779fce0339f93faefc13813cf9aa4b7d3875ff1693f71ad42a4a88bd93a44jprovenance¡hobjectIdxGsha256-5ac779fce0339f93faefc13813cf9aa4b7d3875ff1693f71ad42a4a88bd93a44ftargetxGsha256-5ac779fce0339f93faefc13813cf9aa4b7d3875ff1693f71ad42a4a88bd93a44mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-d81ab2041773cd7709e36d330b739371178e0a68c38c1b66a2796de5d32dd367dkindjclaims.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-fae5a691a261dcc7cc59f0f7a0a2b52a54e90997ae31f1eb3f721ed17a916de7jprovenance¡hobjectIdxGsha256-fae5a691a261dcc7cc59f0f7a0a2b52a54e90997ae31f1eb3f721ed17a916de7ftargetxGsha256-fae5a691a261dcc7cc59f0f7a0a2b52a54e90997ae31f1eb3f721ed17a916de7mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-e8a286c49eb03d3a4692d4e2d1df94ea7c0aa08788d35ac541f8c3d56c84d862dkindjsource.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-8ff9febf1fc88e3f582361fafb1dab81d80c0a5d07faff2eb338753bf58299b7jprovenance¡hobjectIdxGsha256-8ff9febf1fc88e3f582361fafb1dab81d80c0a5d07faff2eb338753bf58299b7ftargetxGsha256-8ff9febf1fc88e3f582361fafb1dab81d80c0a5d07faff2eb338753bf58299b7mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-ed00b9e2108224482a157c05f1592f7ff48a077858beb388d533f311fe3983c3dkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-49e769228c1d1a747011ab041c5af2fd8565d2f975ec5db8651b57e5e93c97adjprovenance¡hobjectIdxGsha256-49e769228c1d1a747011ab041c5af2fd8565d2f975ec5db8651b57e5e93c97adftargetxGsha256-49e769228c1d1a747011ab041c5af2fd8565d2f975ec5db8651b57e5e93c97admtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounter bidxGsha256-f2c2811cbc9092638c02479ad9edbeae8ea8334902101db72995f56f33d4c2ffdkindjagents.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-6e600a9fb28582b75c9a83be09721b0ce6f750c54cc21751919e33b815ccd222jprovenance¡hobjectIdxGsha256-6e600a9fb28582b75c9a83be09721b0ce6f750c54cc21751919e33b815ccd222ftargetxGsha256-6e600a9fb28582b75c9a83be09721b0ce6f750c54cc21751919e33b815ccd222mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-f5c0126284abf344b7e16548cf20689fab7f963954bbe3a7a4e971ed70aee129dkindldocument.putgparentsxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gpayloadxGsha256-c79d52222b043d46698ea619e85bb9380ea5c7c4b5403bfe094b8df037199acdjprovenance¡hobjectIdxGsha256-c79d52222b043d46698ea619e85bb9380ea5c7c4b5403bfe094b8df037199acdftargetxGsha256-c79d52222b043d46698ea619e85bb9380ea5c7c4b5403bfe094b8df037199acdmtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionªeactorqknolo-v4-migratorlactorCounterbidxGsha256-f9f848496edbf3cdb634fb7aa402e856fb0145e104fdf00630a351dd10491230dkindldocument.putgparents€gpayloadxGsha256-001a34cf42223b23b87a15f9f369e1bfa55afdc70b6142f538a0e5f4eb238828jprovenance¡hobjectIdxGsha256-001a34cf42223b23b87a15f9f369e1bfa55afdc70b6142f538a0e5f4eb238828ftargetxGsha256-001a34cf42223b23b87a15f9f369e1bfa55afdc70b6142f538a0e5f4eb238828mtransactionIdxGsha256-510846a8c745c7ca121748bc0e88d325ac1ecf2f4d24bec00cc052952737d021gversionKSEGG%©°]ü¢7…FŽý:ƒcÄ4úd!ò…m&ضó­eactorqknolo-v4-migratorieventRootxGsha256-fad949b97d9e2f44edaf8363929064beb1e0cae9ae6a0d728f4fb5a4342445b7reventSegmentDigestxGsha256-f20123f59ef77f00647eba1ac77e0904d0d45f77f156a7d35de63fa8cbae6a4ajobjectRootxGsha256-5b63085d33a414b651a336718458d1d63aaa1c21fadfed89ac0f7a2fc3631c15sobjectSegmentDigestxGsha256-e7d5d230a582c61b126e0e7684127eb5e5225215b7cd5c2b0b8acb2549c9aea9gparents€jpolicyRootxGsha256-92a33041498984ee8303a0862158a6624776418fd5b854fb293d66e63febee9foruntimeContractxGsha256-21c14cbf9139b7cb3186e9081668668a7dab762f490a11c4a86bed5c0ead2ca8jschemaRootxGsha256-babaf64c1c0e673411504b9d015f62e723b9058035b7d5e5678bbb30163a5e86hsequenceotransactionRootxGsha256-c74c9c0e77b743c62105c83c560f60b00bc44825fb709879a3f821683f455e16gversioneviews¡glexicalxGsha256-62e1594263053cccfeb062058c7d8abfc11df1faf4cfd57afb80ec6c43c762fd