🔧 Cursor's CORS Config Is Wide Open by Default (Here's the Fix)

TL;DR



Cursor and Claude Code default to cors() with no arguments -- any website can read your API responses
CWE-942 affects Express, Fastify, and FastAPI backends generated without explicit origin config
Fix: pass an explicit origin array and set credentials: true; browsers enforce the restriction for you


I reviewed four side projects last...