CORS wildcard on the public document
Scan rule · RSC-SEC-006
- Security
- Severity: Info
- CWE-942
Records `Access-Control-Allow-Origin: *` on HTML — not a flaw by itself, but a signal to check.
Scan tier
- External scan (anonymous)
How to fix it
Make sure authenticated API endpoints never allow a wildcard origin.