CORS Free-For-All

What it is

API surfaces exist without visible proof of restrictive CORS, security headers, or production header policy.

This usually appears when generated code proves that a feature works but does not leave enough evidence that the launch boundary was checked.

How to fix it

Add explicit CORS allowlists, security headers, and deployment smoke checks for headers.

1. 1Replace permissive CORS with explicit origin allowlists.
2. 2Add browser security headers in deployment config.
3. 3Smoke-test production headers after deploy.

How VibeAudit checks for this

VibeAudit checks this with Q0_EXTERNAL_SHALLOW response-header observations, one CORS Origin probe, and SAST_LOCAL_STRUCTURAL CORS or header configuration evidence when supplied. The free tier may show the surface name only, without private evidence or remediation details. Metadata-only surface maps do not create missing-control findings. Unsupported private repositories, authenticated behavior, destructive workflows, account configuration, and business logic remain unverified unless the scan includes matching local, imported, or authorized runtime evidence.

Related failure modes