rasengan-server-uploads

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required workflow is an HTTP multipart upload endpoint (e.g., router.post('/upload/avatar', upload.single('avatar')...)) where the client controls multipart fields like originalname/mimetype and any non-file text fields, which are parsed from the request at runtime and can become LLM-readable strings via ctx.body and ctx.get('file')/ctx.get('files') (indirect prompt injection risk if the app later forwards these into the LLM).