CORS PRE-SCAN REPORT
=====================
files scanned : 3
findings      : 12

[HIGH  ] CORS-REFLECT-CRED      nginx.conf:4
         request Origin reflected into Access-Control-Allow-Origin while credentials are enabled (cred line 5) — any site can read authenticated responses cross-origin
[HIGH  ] CORS-REFLECT-CRED      server.js:8
         request Origin reflected into Access-Control-Allow-Origin while credentials are enabled (cred line 9) — any site can read authenticated responses cross-origin
[HIGH  ] CORS-WILDCARD-CRED     server.js:15
         Access-Control-Allow-Origin: * combined with Allow-Credentials (cred line 9) — browsers refuse the combination; the intent is wrong and often sits next to a reflected-origin fallback
[MEDIUM] CORS-ALLOW-ALL         server.js:15
         framework-level allow-every-origin (raw-*) — every website can read this service's responses
[MEDIUM] CORS-SUBSTRING         server.js:21
         origin checked by substring/suffix match — bypassable via attacker-controlled domain that contains the trusted string
[MEDIUM] CORS-ALLOW-ALL         server.js:24
         framework-level allow-every-origin (express-default-*) — every website can read this service's responses
[MEDIUM] CORS-ALLOW-ALL         settings.py:2
         framework-level allow-every-origin (django) — every website can read this service's responses
[MEDIUM] CORS-NULL-ORIGIN       settings.py:5
         'null' in allowed-origins list — sandboxed iframes and redirects send Origin: null
[LOW   ] CORS-ANY-METHOD        nginx.conf:6
         wildcard allowed methods/headers
[INFO  ] CORS-NO-VARY           nginx.conf:4
         origin-dependent ACAO but no 'Vary: Origin' — shared caches may leak one origin's grant to another
[INFO  ] CORS-NO-VARY           server.js:8
         origin-dependent ACAO but no 'Vary: Origin' — shared caches may leak one origin's grant to another
[INFO  ] CORS-NO-VARY           settings.py:2
         origin-dependent ACAO but no 'Vary: Origin' — shared caches may leak one origin's grant to another

Scope: deterministic pre-scan only — not an audit.