sast-config

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.70). The required workflow ingests and analyzes repository SAST configuration files (e.g., Semgrep YAML, CodeQL config/queries) as readable text at runtime, and those files can be authored/modified by outsiders (e.g., via PRs), creating an indirect prompt-injection path through untrusted configuration content.