ping-orchestration-reactjs-js-davinci-sdk

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.80). The DaVinci client is initialized at runtime with the PingOne discovery URL (e.g. https://auth.pingone.com/<ENV_ID>/as/.well-known/openid-configuration), and the SDK uses the PingOne orchestration endpoints (discovered from that URL) to fetch dynamic collector objects that directly determine the UI prompts/flow, so this external URL is a required runtime dependency that controls prompts.