bridge-api-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required runtime workflow is a webhook handler that reads the incoming HTTP request body as text/bytes (outsider-authored provider payload), then parses it (e.g., Next.js await request.text() / Express express.raw() + JSON.parse), which is untrusted free-form content that can indirectly become LLM context if the handler logs or forwards it.