CORS reflects any origin with credentials

Why it matters

Any website can make logged-in requests to your API and read the answers.

How to fix it

Allow only your own origins in Access-Control-Allow-Origin, never reflect the request's Origin with credentials.

How we test it

Passive — runs in the free check, looks only at what a browser can see.