kelly-invest-webull

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The runtime path app/app/js/providers/busabase-provider.js:getState() uses Busabase records.list to ingest all accounts, positions, and settings rows (including free-text fields like display-name, symbol, name, and warnings), which an outsider could poison by writing into a queue/feed the app reads via records.list.