Cursor's CORS Config Is Wide Open by Default...

TL;DR Cursor and Claude Code default to cors() with no arguments -- any website can read your API responses CWE-942 affects Express, Fastify, and FastAPI backends generated without explicit origin config Fix: pass an explicit origin array and set credentials: true; browsers enforce the restriction for you I reviewed four side projects last week, all vibe-coded with Cursor. Clean structure, decent test coverage, working auth flows. Then I checked the CORS configuration in each one. Every single o