live-dev-deploy

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). It ingests GitHub Deployments API response data at runtime via resources/resolve-preview-url.js (calls gh api repos/{owner}/{repo}/deployments?... and then .../statuses to read target_url), where the underlying deployment/target_url values could be influenced by untrusted outsiders through GitHub deployment/status creation flows.