Repository navigation
Security update: React 19.0.3 - #3
Merged
Merged
Conversation
manager
added a commit
that referenced
this pull request
May 21, 2026
…usory truth)
Two new entries that follow the same structure as availability-heuristics:
scenario, two side-by-side email-style cards (with the bias-exploiting
side flagged), why-it-works paragraph, and a four-move Protect-yourself
list keyed to the bias mechanism.
- Attentional bias: a loud "URGENT sign-in from Moscow" decoy beside a
quiet "updated wire details" ask one minute earlier. The bias mechanism
is attention budget — the noisy one is bait, the quiet one is the
attack. Defenses: scan the same window after the loud event, never
trust an alert's link, decoys travel in pairs.
- Illusory truth effect: a cold "vendor banking update" ask vs. the
same content reframed as a third touch ("Re: Re: ... as mentioned
last week"). Two prior friendly notes were a deposit into your
credibility account; the third is the withdrawal. Defenses: thread
length is not verification, treat first money/credential ask as new
no matter how familiar, cross-check sender against external contacts.
Plus a small refactor: OffsecBiasContent moved out of
availabilityHeuristics.ts into a dedicated types.ts so the type now
defines attachment/flagged as truly optional and the same shape applies
across all 105 future biases without each file needing to mirror every
field of the first one.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
manager
added a commit
that referenced
this pull request
May 21, 2026
…chat DMs Email was overused for the first three examples. Generalised the visual chassis with a discriminated card kind so each bias picks the surface that matches its actual attack vector. Email stays for availability (news-anchored phishing IS email-shaped); attentional bias #2 pivots to two competing push notifications (Microsoft Defender "unauthorised sign-in" decoy vs Wire Approvals "bank details changed" quiet ask); illusory truth #3 pivots to a LinkedIn-style chat (cold ask vs same message reframed as the third touch with a "2 messages this month" context line). Future biases (browser alerts, OS dialogs, voice calls, etc.) can add their own card kind to types.ts without breaking the existing two. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.