formio-actions

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Form.io “actions” run server-side on submission events and can render/interpolate and send user-provided submission field values (outsider-authored free text) via Email and Webhook after the submission is saved (e.g., message: "{{ submission(data, form.components) }}" and webhook payload includes /* original submission body */).