Risk: webhook events contain customer data inserted into the database. If the response fields are not validated, a compromised or spoofed webhook can inject SQL or HTML into stored records. API10 pattern: process webhook payloads as untrusted input, not as inherently safe structured data.

Risk: addresses, city names, and country strings returned from enrichment APIs are stored directly in the database or displayed to users. A compromised enrichment API can return SQL injection in an address field or XSS in a location name. Log4Shell was triggered through enrichment data logged by applications.

Risk: the OAuth token exchange response contains fields (email, name, profile URL) that are stored and displayed. A redirect URI returned by the provider can be followed without validation. A compromised identity provider can inject malicious values into profile fields.

Risk: delivery webhook callbacks contain recipient addresses, event metadata, and custom fields that are processed and stored. Unvalidated webhook data can be used for injection attacks if the attacker can influence what gets sent in the callback.

Risk: scripts loaded from third-party CDNs run with full DOM access on the host page. If the CDN file is tampered (as with Ticketmaster/Inbenta), the script can access and exfiltrate any data on the page — form fields, session tokens, payment card data. No API call is needed — just trust in the CDN URL.