neon-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.90). The required runtime workflow is verifying and parsing incoming Neon webhook requests; those requests (raw body/headers like X-Neon-Signature, X-Neon-Timestamp, X-Neon-Event-*) are outsider-authored free text delivered over the public webhook endpoint, and the code then JSON-parses the raw body into application context (even though it uses it mainly as data, not an LLM prompt).