Will It Vibe?CORS configured with a wildcard origin
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
The cors middleware or an Access-Control-Allow-Origin header is set to '*', so any website can read responses from this API.
Why it matters
Setting the CORS origin to '*' lets any website read this API's responses from a victim's browser. For a public, unauthenticated, read-only API that can be intentional, but on anything that returns user-specific or authenticated data it exposes that data cross-origin. A wildcard also cannot be combined with credentials, so it often means the CORS setup was never really configured.
How to fix it
Replace the wildcard with an explicit allow-list of trusted origins, and validate the incoming Origin against it rather than reflecting it. Only enable credentials for origins you control. If the API really is public and static, document that the wildcard is deliberate.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo