vendor-privacy-due-diligence

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.85). The workflow ingests vendor-provided questionnaire responses and supporting evidence (outsider-authored free text) via the runtime path where the system records QuestionnaireResponse.vendor_response and evidence_description into assessment.responses (e.g., record_questionnaire_response()), which would then be available for any LLM context building.