praxis-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime webhook handlers (e.g., Express/Next.js/FastAPI) directly parse outsider-submitted HTTP request body text (JSON from the POST) and use fields like event/transaction_status derived from that content for downstream handling after signature verification.