usps-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Runtime POST handler reads the webhook request body (payload string) originating from an outsider (USPS/public internet sender) and parses/uses it in handler logic (potential indirect prompt injection surface if the app later forwards fields to an LLM), e.g. JSON.parse of raw request text in the Next.js route.