Checks · HDR-005

HDR-005 · CORS allows any origin with credentials

Why it matters

Reflecting any origin and allowing credentials lets another website call your API as the visitor.

How we detect it

An OPTIONS request with a foreign Origin receives that origin back with credentials allowed, or a wildcard with credentials.

How we fix it

Allow only the origins you own.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-008 · Hard-coded admin email or password
• AUTH-001 · Admin route without auth check
• AUTH-002 · Authorization by client-side flag only
• AUTH-003 · Supabase user_metadata used for roles