I really don't understand what you're saying. Your zap request has all the info about who/what you are zapping and that can't be modified.
Discussion
https://void.cat/d/DXmSmpSy7SmSgUG7Jt2ExG.webp
One of these is real.
Two of them are self-payments that still show up as actual zaps to Odell.
Right but where you’re getting the invoice from can be modified. It’s just an endpoint. The rest of the &Nostr= part remains the same.
how can that be modifed? Clients fetch it from the users lnurl over https
It’s just a GET endpoint you get from browser devtools. Maybe I’m missing your point?
I could fetch an invoice from MY Lightning address and attach a zap note for YOUR note to it, no?