vapi-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the Express/Next.js/FastAPI required runtime workflow, the /webhooks/vapi POST handler ingests outsider-authored JSON from the request body (body.message.*) at runtime after (optional) shared-secret verification, and it uses fields like message.type/message.transcript directly in logic/logging.