igrantio-holder-backend

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In references/src/notificationsSse.ts, the backend relays the upstream OWS Server-Sent Events stream for {tenant}/v2/config/digital-wallet/openid/notifications/sse by reading and streaming the upstream response body (which can include outsider-authored notification payloads) into the HTTP response without selecting a specific item.