smartcar-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). Outsider free text (Smartcar webhook body fields and data.challenge) is received at runtime via the public HTTP webhook endpoint, parsed as JSON in the generated handlers (examples/express/src/index.js uses express.json() into req.body; examples/nextjs/app/webhooks/smartcar/route.ts reads await request.text() then JSON.parse; examples/fastapi/main.py reads await request.body() then json.loads).