implementing-saaskit-python

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The workflow ingests outsider-authored free text from an HTTP request query/body (e.g., /auth/callback?code=...&state=... and cookies/params like state/code) via the runtime web framework (FastAPI/Django/Flask request.args/request.GET/cookie reads), which is uncontrolled by the operating user and can contain prompt-injection strings.