Scan rule · RSC-SEC-006
CORS wildcard on the public document
SecuritySeverity: InfoCWE-942
Records `Access-Control-Allow-Origin: *` on HTML — not a flaw by itself, but a signal to check.
Scan tier
External scan (anonymous)
How to fix it
Make sure authenticated API endpoints never allow a wildcard origin.