wapi-nextjs

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In references/webhook-route.ts, the runtime POST webhook handler reads and parses attacker-supplied JSON from the request raw body (req.text() / JSON.parse(raw)) and then passes untrusted data fields into processing (e.g., deriving text and logging).