fal-studio

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). In the app flow, outsider-authored text (the user’s prompt and optional uploaded image URL) is ingested at runtime via the app’s server route (app/api/fal/proxy/route.ts/POST(req) in references/fal-runtime.md) where prompt is validated and then passed into fal.queue.submit(... input: { prompt: body.prompt, ... }).