square-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Square webhook event handling ingests outsider-authored POST request bodies (raw HTTP body text) at /webhooks/square, parsing JSON.parse(rawBody) after only HMAC signature verification, so an outsider who can POST to the public endpoint can supply arbitrary free text payloads.