Your AI Wrote a CORS Config That Lets Any Website Read Your API

TL;DR AI assistants default to Access-Control-Allow-Origin: * — a wildcard that opens your API to every domain on the internet When combined with a naive credentials check, this escalates from sloppy to exploitable Audit every CORS config your AI generated and replace wildcards with explicit origin lists I was reviewing a side project a friend built with Cursor last month. Node/Express backend, straightforward REST API, nothing fancy. The app worked fine. The CORS setup was a different story. Every route was wide open. One line at the top of the file: app.use(cors()) . No origin list, no credentials check, no thought. Just a call to the cors package with zero config. I've seen this pattern in probably a third of AI-generated Express apps I've touched this year. The default behavior of cors() in Express sets Access-Control-Allow-Origin: * . That means any website on the internet can make cross-origin requests to the API from a visitor's browser. For a read-only public API, that's maybe