Expected Findings
- Wildcard origin and credentials are enabled together.
- Profile data is accessible with no meaningful access control.
API Policy Demo
CORS Misconfig
The preview fetches an authenticated-looking endpoint and prints the permissive CORS headers that should never be sent together.
CORS probe
Primary Flows
- Profile API Returns permissive CORS headers
Signals
Headers
Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true