dt-sec-semantic-mapping

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Workflow B2 runtime validation loads and queries live tenant security.events (including dt.raw_data / event.original_content and sample-event fields) for the provider specified by the user, so any outsider who can cause tenant events/fields to be ingested can indirectly supply free text the LLM reads at runtime.