CheckVibeCodeCheckVibeCode
Checks/Vulnerability
VulnerabilityLive5 checks

CORS Misconfiguration Scanner

Detect dangerous CORS policies that could allow unauthorized cross-origin access.

Run this scanSee pricing

How this scan works

  • Send Origin: https://evil.example and inspect Access-Control-Allow-Origin
  • Flag reflected-origin responses (ACAO echoes the sent Origin) combined with Access-Control-Allow-Credentials: true
  • Flag a wildcard * on credentialed endpoints
  • Check preflight (OPTIONS) handling on API-shaped routes (/api/*)
  • Check Access-Control-Allow-Methods/Headers for over-broad allowances

More checks in Vulnerability

SQL Injection ScannerCross-Site Scripting (XSS) ScannerAPI Key Exposure ScannerCSRF Protection ScannerAuthentication Flow ScannerOpen Redirect Scanner