frontend-data-contracts

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow is the shared/api-client/client.ts fetch boundary, which ingests only server JSON responses (outsider-authored) and parses them into typed values; this is indirect prompt injection risk because arbitrary server-provided strings (e.g., error.message/fields) become LLM-readable context via thrown ApiError objects and any logging/serialization.