The AI PR that fixed CORS by allowing everyone

I keep seeing this in agent-written PRs.

The frontend could not call the API. CORS error in the console. The agent “fixed” it. Fetch works again. Then you open the diff and the bug is still there. The real change is an open door: Access-Control-Allow-Origin: *, reflecting any Origin, or * plus Access-Control-Allow-Credentials: true. Green because the browser stopped blocking.

You did not ask for a public API. You asked for one browser origin to talk to your backend without leaking cookies or tokens to every site on the internet.

The 60-second check I run now

When an agent PR claims to fix CORS, “blocked by CORS policy”, preflight, or Origin errors:

1. Diff the “fix.” Did it allow the one real origin (or a short allowlist), or did it open * / echo any Origin?
2. Ask what still fails if a random site tries the same call with the user’s cookies. If the PR cannot name a failure mode that rejects a foreign origin, bounce it.
3. If the only change is * (or reflect-any-Origin) — especially with credentials — I reject it until the real allowlist is owned or the open path is temporary, scoped, and documented.

This is one of the stops on a short bar I use before I merge agent PRs. Free one-pager if you want the rest: https://chopragunji.gumroad.com/l/zpnmdn

If you'd rather someone else do a hard pass on one scary AI PR, I still have founding slots at $49 (normally $99): https://chopragunji.gumroad.com/l/byoyi/FOUNDING

Have you merged an agent “CORS fix” that was really just allow everyone?