8.49Security and DataWeave

Remember:

payload

may contain secrets too.

Example inbound webhook:

{
  "authorizationToken": "...",
  "customer": {...}
}

Don't accidentally transform that into:

logger payload

or propagate it into Salesforce.

Use explicit field mapping:

{
    Name: payload.customer.name,
    External_Id__c: payload.customer.id
}

rather than blindly passing the original object through.

Explicit mapping can be a security boundary.