TL;DR



AI editors almost always default to cors() with no config -- which sets Access-Control-Allow-Origin: *

Wildcard CORS on authenticated APIs exposes your users to cross-site request attacks
Fix: replace the wildcard with an explicit origin allowlist controlled by an env var


I was reviewing a side project a dev built entirely in Cursor....