igrantio-backend-webhooks

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required runtime workflow includes accepting a POST /webhook from an external party and parsing the outsider-authored HTTP request body (raw(...) → rawBody.toString() → JSON.parse → stored into data/type), which can then be forwarded to the browser via the SSE/event stream (prompt-injection risk if later fed to an LLM).