backend-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). Incoming webhooks are read and JSON-parsed from outsider-controlled HTTP request bodies/headers in the webhook receiver/handler path (e.g., signature verification and event processing in the described Express app.post('/webhooks/:provider', ...) / verifyWebhook(...) and processEvent(req.body) flow).