https://shipreadyai.dev/learn/findings/o13-cors-ok

> Discover all available pages from the documentation index at https://shipreadyai.dev/llms.txt

# Cross origin rules are narrow or absent

A request from an outside origin came back without a header inviting other sites to read the response.

## Why AI-built apps get this

Cross origin rules get widened during development, when a local page needs to talk to a deployed backend. The wildcard that unblocked the afternoon stays in the deployed version, because nothing about it fails afterwards.

## Evidence line

GET /api/ with an outside origin returned access-control-allow-origin: * with credentials allowed

## The fix

Nothing to change here.

## Prompt

Keep the cross origin allow list limited to your own addresses.